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Abstract. Let A; be a field of cliaracteristic p > 0, let g be a power 
of p, and let u be transcendental over k. We determine all polynomials 
/ G k[X] \ k[X''] of degree q{q — l)/2 for which the Galois group of 
f{X) — u over k{u) has a transitive normal subgroup isomorphic to 
PSL2(q), subject to a certain ramification hypothesis. As a consequence, 
we describe all polynomials / G k[X] such that deg(/) is not a power 
of p and / is functionally indecomposable over k but / decomposes over 
an extension of k. Moreover, except for one ramification configuration 
(which is handled in a companion paper with Rosenberg), we describe all 
indecomposable polynomials / G k[X] such that deg(/) is not a power 
of p and / is exceptional, in the sense that X — Y \s the only absolutely 
irreducible factor of f{X) — f{Y) which lies in k[X, Y]. It is known that, 
when k is finite, a polynomial / is exceptional if and only if it induces 
a bijection on infinitely many finite extensions of k. 



1. Introduction 

Let C and P be smooth, projective, geometrically irreducible curves over 
a field k of cliaracteristic p > 0, and let / : C ^ P be a separable morphism 
over k of degree d > 1. Much information about the map / is encoded in 
its monodromy groups, which are defined as follows. Let k{C)/k{'D) be the 
separable field extension corresponding to /, and let E denote its Galois clo- 
sure. The arithmetic monodromy group of / is the group A := Gal{E/k{'D)). 
Letting i denote the algebraic closure of k in E, the geometric monodromy 
group of / is G := Gal{E/i{V)). 

A fundamental problem is to determine the possibilities for the mon- 
odromy groups and the ramification of such maps /, where P is fixed and C 
(and /) varies. Riemann solved this problem in case k = C, and moreover he 
determined how many such maps / have a specified monodromy group and 
specified branch points and inertia groups (although it remains unknown 
how to write down equations for these /). Riemann's result can be gener- 
alized to the case that k is any algebraically closed field of characteristic 
zero; but the problem becomes much more difficult for other fields k. In 
case k is an algebraically closed field of characteristic p > 0, the best result 
to date was proved by Raynaud [35] and Harbater [25], and describes the 
geometric monodromy groups of maps / whose branch points are contained 
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in a specified set. However, the problem of determining tlie possible inertia 
groups (not to mention the higher ramification groups) is wide open. 

In this paper we explicitly determine all maps / (in positive characteris- 
tic) having certain monodromy groups, subject to a constraint on the ram- 
ification. The specific situation we consider arises in questions about two 
special types of maps /. In many applications, one is interested in maps / 
satisfying some additional hypotheses; in practice, one often finds that nat- 
ural hypotheses on / imply severe restrictions on the monodromy groups. 
Classifying the groups satisfying such conditions often requires deep group 
theoretic results (by contrast, no difficult group theory was involved in the 
proofs of Raynaud and Harbater). We need some notation to describe our 
situation. The map / induces a transitive permutation representation of A 
on a set A of size d. Let Ai be a point stabilizer in this representation, and 
note that G is also transitive on A. 

In this paper we study maps / having some of the following conditions; 
some of these conditions are geometric and some arithmetic, and all of them 
have been studied for over a century. In our list we include translations of 
the conditions into properties of the monodromy groups. 

(i) / is (arithmetically) indecomposable (i.e., / is not a nontrivial com- 
position of maps defined over k). This is equivalent to being a 
maximal subgroup of A. 

(ii) / is geometrically indecomposable. This is equivalent to Ai f] G 
being maximal in G. 

(iii) / is totally ramified at some point. This says an inertia group in 
the Galois closure of / acts transitively on A. 

(iv) C has genus g. This can be translated to a property of G and the 
higher ramification groups, via the Riemann-Hurwitz formula and 
Hubert's different formula. 

(v) The fiber product {{c,d) £ C x V : f{c) = f{d)} has no geometric 
components defined over k except the diagonal. This says that A 
and G have no common orbits on A x A besides the diagonal. 

In case (v) we say / is an exceptional map. These have been studied ex- 
tensively (starting with Dickson's 1896 thesis [6], and subsequently by Schur, 
Carlitz, Davenport, Lewis, Bombieri, Fried, Cohen, and others). They are 
particularly interesting when k is finite. In this case, / is exceptional if and 
only if / is bijective on A:'-rational points for all extensions k' /k of degree 
relatively prime to some positive integer m (which can always be taken to be 
|A : G|). Indeed, as long as the cardinality of k is sufficiently large compared 
to the degree of / and the genus of C, exceptionality is equivalent to ei- 
ther injectivity or surjectivity of the map induced by / on /c-rational points. 
Moreover, for finite k, the composition of two maps C ^ B and B ^ T> 
is exceptional if and only if both maps are exceptional; thus, it suffices to 
classify the exceptional maps that are arithmetically indecomposable. For 
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proofs of these results, see [23l p. 2] and [\A\ p. 185]. For partial analogues 
over infinite fields, see [22l [271 El]- 

We will be especially interested in the case that / is a polynomial; here C 
has genus g = 0, and / is totally ramified over a rational point of D (namely, 
the point at infinity). 

In this paper (except for a few cases handled in [191 [20] ) , we classify the 
polynomials f{X) S k[X] such that deg(/) is not a power of char (A;) and at 
least one of the following holds: 

(1) / is arithmetically but not geometrically indecomposable; 

(2) / is exceptional and arithmetically indecomposable; or 

(3) A has a transitive normal subgroup isomorphic to PSL2((7). 

It was shown in [21] that there are significant restrictions on the mon- 
odromy groups of an arithmetically indecomposable polynomial. In this 
paper we will study the groups that can occur for polynomials / which sat- 
isfy either (1) or (2). We will see that these usually give rise to condition 
(3). It would be of great value to have a classification of all indecomposable 
/ for which G is neither alternating nor symmetric; from ^21j we know that 
the situation in case (3) is one of the main sources of such polynomials /. 
In characteristic 0, all such / are known [111 [T2| I33j : in that case there are 
no polynomials satisfying (1), and the polynomials satisfying (2) have been 
classified flS]. 

We now consider (1) in more detail. The problem here is to find inde- 
composable polynomials over k which decompose over a bigger field. There 
are many examples of such polynomials in the classical family of additive 
polynomials ^ cxiX^^ ; further examples occur in the related family of sub- 
additive polynomials, where we say S{X) £ k[X] is subadditive if there is a 
positive integer m and an additive polynomial L such that L{X)''^ = S{X'^). 
Up to composition with linears, these were the only examples known before 
1993. Work of Guralnick and Saxl |21[ [22] showed that there are severe 
restrictions on the degree of any polynomial satisfying (1). We extend and 
refine their result as follows, and in particular we determine all such polyno- 
mials whose degree is not a power of the characteristic; these include some 
variants of a degree-21 example found by Miiller, as well as new examples 
of degree 55. 

Theorem 1.1. Let k be a field of characteristic p. If f £ k[X] is indecom- 
posable over k but decomposes over some extension of k, then one of the 
following holds: 

(i) deg(/) = p'^ with e > 2; 
(fi) deg(/) = 21 and p = 7; 
(iii) deg(/) = 55 and p = 11. 

For k of characteristic p G {7, 11}, there exist such f of degree not a power 
of p if and only if k contains nonsquares; moreover, all such f are described 
in Theorem \4-4\ 
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We note that a new family of examples of degree was found recently 
by Beals and Zieve [T], and we expect that these examples (and the additive 
and subadditive examples) will comprise all examples of degree ]f . 

Now consider (2). The classical examples of exceptional polynomials are 
the additive and subadditive polynomials discussed above (which are excep- 
tional precisely when they have no nonzero root in A;), the multiplicative 
polynomials X'^ (which are exceptional when k contains no d-th roots of 
unity besides 1), and the Dickson polynomials /^^(X, a). Here for a G A; 
the Dickson polynomial is defined by the equation D^iY + a/Y,a) = + 
(a/y)*^, and its exceptionality criteria are similar to those of Dd{X, 0) = X'^. 
All of these examples occurred in Dickson's 1896 thesis [6], and no further 
examples were found for almost a century. In fact, the theme of most work in 
the century following Dickson's thesis was to show that compositions of the 
known exceptional polynomials (including linear polynomials) comprised all 
exceptional polynomials in some situations. Klyachko [26j proved this for 
polynomials whose degree is either equal to or coprime to p. Cohen [4] and 
Wan [41j proved the same result for degree 2p. The following result of Pried, 
Guralnick and Saxl |14l [22] provides a vast generalization of these results: 

Theorem 1.2. Let k be a field of characteristic p, and let f £ k[X] be inde- 
composable and exceptional of degree d > 1. Then the geometric monodromy 
group G of f satisfies one of the following conditions: 

(i) G is cyclic or dihedral of odd prime degree d ^ p. 

(ii) d = p^ and G = xi Gi, where acts on itself by translations 
and Gi < GL(F;). 

(iii) p £ {2,3} and d = p^ijf — l)/2 with e > 1 odd, and PSL2(p^) is a 
transitive normal subgroup of G. 

In particular, the degree of an indecomposable exceptional polynomial is 
either (i) a prime distinct from p, or (ii) a power of p, or (iii) p'^(p^ — l)/2 
with e > 1 odd and p £ {2, 3}. Any polynomial in (i) is (up to composition 
with linears) a Dickson polynomial Dd{X,a) with a £ k; see |34[ Appendix] 
or [26]. Case (ii) includes the additive polynomials (where Gi = 1) and 
the subadditive polynomials (where Gi is cyclic). In joint work with Miiller 
[171 118j . we have found families of examples in which Gi is dihedral, and 
we suspect that no further examples exist in case (ii). This is based on the 
following reasoning: let E denote the Galois closure of k{x)/k{f{x)) (with 
X transcendental over k), and let F denote the subfield of E fixed by F^. 
We show in [18] that, in any further example of (ii), the genus g F would 
satisfy g > 1 (whereas all known examples have g = 0). But then Gi is a 
group of automorphisms of F whose order is large compared to g, and there 
are not many possibilities for such a field F [24]. We hope to complete the 
analysis of case (ii) in a subsequent paper. The present paper addresses case 
(iii), which does not include any classical examples. 

Case (iii) was studied intensively in the two years following [14] , resulting 
in examples with k = ¥p for each odd e > 1 and either p = 2 (Miiller [32] . 
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Cohen-Matthews ^) oi p = 3 (Lenstra-Zieve [2H])- In the present paper 
we analyze this case in detail: we identify all possibilities for the ramifica- 
tion in k{x)/k{f{x)), and for all but one such possibility we determine all 
the corresponding exceptional polynomials (cf. Theorems 14.21 and I4.3P . This 
leads to new examples of indecomposable exceptional polynomials, which 
are twists of the examples found in [U [28l I32j . In a companion paper with 
Rosenberg [19], we complete the analysis of case (iii) by analyzing the final 
ramification possibility (which yields a new family of exceptional polynomi- 
als). A simplified version of Theorem 14.21 is as follows (and the shape of 
Theorem 14.31 is similar): 

Theorem 1.3. Let k be a field of characteristic 3, and let q = 3^ with e > 1 
odd. The following are equivalent: 

(i) there exists an indecomposable exceptional polynomial f G k[X] of 
degree q{q — l)/2; 

(ii) A; n Fq = F3 and k contains non-square elements. 

Moreover, these polynomials f are precisely the following (up to composition 
on both sides with linear polynomials in k[X]): 



where n divides {q + l)/4 and the image of a € k* in the quotient group 
k*/{k*)'^^ has even order. 

For both of the above problems — finding all indecomposable polynomials 
f{X) G k[X] of degree not a power of char(/c) which either decompose over 
a larger field or are exceptional — we use a similar approach. Write k for 
an algebraic closure of k, and let x and u be transcendental over k. Our 
general strategy is to first translate the desired properties of the polynomial 
into properties of the monodromy groups G = Gal(/(X) —u, k{u)) and A = 
Gal(/(X) — u,k{u)), then find all group-theoretic configurations satisfying 
these properties, and finally, for each group-theoretic possibility, find all 
corresponding polynomials. In our cases, a translation to group theory was 
done in [14], and in that paper and [211 ES] a restricted list of plausible 
pairs (G, A) were given. However, these papers did not use the condition 
that k{x)/k{f{x)) is an extension of fields of genus zero; via the Riemann- 
Hurwitz genus formula and Hilbert's different formula, this condition leads 
to restrictions on the possible ramification in the extension. We apply this 
to each of the pairs (G, A) allowed for our problems by [22], producing a list 
of all possibilities for the ramification. The next step is to determine the 
possibilities for the Galois closure E of k{x)/k{f{x)); once this is done, we 
compute the group Aut^(ii^), find all of its subgroups which are isomorphic 
to G, and for each such subgroup we compute the invariant subfield E'^ and 
then compute the corresponding polynomials. This gives all polynomials 
over k having the desired group theoretic setup geometrically; the final step 
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is to determine which of these polynomials are defined over k and solve our 
original problems. 

The hardest step in our work is the determination of E. The data we are 
given for this is a group G of automorphisms of together with knowledge 
of the ramification in EjE^ (and the fact that E'^ has genus zero). In our 
case, it turns out that E has the shape k{v,w), where v^" — v = and 
n is coprime to p. So we must prove that this field is determined by its 
ramification over a certain subextension; before stating the result, we give 
a simple lemma describing the ramification in the relevant subextension. 

Lemma 1.4. Let k be a field containing ¥q, let n > 1 be coprime to q, 
and let r > 0. For any 7 G k* , let v and w be transcendental over k such 
that v'^ — V = jw"'; then the extension k{v,w)/k{w^) is Galois if and only 
if r /gcd{n,r) divides q — 1 and k contains a primitive r-th root of unity. 
Moreover, for any such r, the ramification is as follows (where E = k(v,w) 
and t = w'^ ): 

all ramification in E/k{t) occurs over two places ofk{t): 
the finite prime 0, over which the ramification index is r; 
(f) and the infinite place, which is totally ramified (index qr), and 
over which the sequence of ramification groups has the shape 

h = • ■ ■ = In^ In+1 = 1- 

Theorem 1.5. Let k be a perfect field containing ¥pe, lett be transcendental 
over k, and let n and r be positive integers such that k contains a primitive 
r-th root of unity, p\ n, and r/gcd(n, r) divides p^ — 1. // both (i) and (ii) 
below are satisfied, then any Galois extension E/k{t) having ramification as 
in (t) must have the form E = k{v, w) where v^" —v = 'yw"' and 7 G /c* and 
t = w''. 

(i) n is the least nonnegative integer congruent modulo r to any number 
of the form np^ with i > 0. 

(ii) Either k = F^e or p*^ is the least power of p which is congruent to 1 
modulo r/gcd(n,r). 

Gonversely, if either (i) or (ii) is not satisfied, then there exist Galois ex- 
tensions E/k{t) having ramification as in (f) which do not have the above 
form. 

Condition (i) seems unexpected in this context. It is especially surprising 
that this condition is true for n = (p^ + l)/4 and r = (p^ — \)/2 (assuming 
p^ = 3 (mod 4) and > 3); in this case the subgroup of (Z/rZ)* generated 
by p has order e, but all e elements of the coset of n have least nonnegative 
residue lying in the top half of the interval [0, r]. 

In fact, we do rather more than classify the two special types of poly- 
nomials described above. We determine all polynomials of a general class 
which contains the polynomials of the two special types. In particular, we 
prove the following result (see Theorem 14.11 for a refined version) . 
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Theorem 1.6. Let k be an algebraically closed field of characteristic p > 0, 
let d = {q^ — q)/2 for some power q = p^ , and let f{X) G k[X] \ k[X'^] have 
degree d. Then the following are equivalent: 

(i) G := Gal(/(X) — u,k{u)) has a transitive normal subgroup isomor- 
phic to PSL2((7), and the Galois closure of the extension k{x)/k{f{x)) 
does not have genus {q^ — q)/2. 

(ii) There exist linear polynomials ii,i2 G k[X] such that the compo- 
sition ii o f o £2 is one of the following polynomials or one of the 
exceptions in Table B (which follows Theorem \4-l^ : 




In these examples, G = PSL2((7) if m even, and G = Y'GL2{q) if m odd. 

In the examples hsted in (ii) (ignoring those in Table B), the cover 
/: — > is only ramified over 00 and 0, and any inertia group at a point 
over (in the Galois closure cover) is cyclic of order {q + l)/m. There is a 
point over 00 (in the Galois closure cover) whose inertia group is the group 
of upper-triangular matrices in G, and whose higher ramification groups 
(in the lower numbering) satisfy Ii = I2 = ■ ■ ■ = In ^n+i = where 
n = m/gcd(m,2). The Galois closure of k{x)/k{f{x)) is k{v,w) where 
v"^ — V = . We also prove some results in case the Galois closure has genus 
{q^ — q) /2; we complete the analysis of this case in the papers [191 ISO]- 

This paper is organized as follows. In the next section we determine all 
group theoretic possibilities which could correspond to a polynomial as in 
the previous theorem. In Section 3 we examine when the group theoretic 
data determines the Galois closure E, and in particular prove Theorem 11.51 
In Section 4 we use knowledge of E to classify polynomials satisfying the 
properties discussed above. For convenience, we collect various elementary 
group theoretic facts in an appendix. 

The second author thanks Hendrik Lenstra and Henning Stichtenoth for 
valuable conversations. 

Notation: Throughout this paper, A; is a field of characteristic p > 0, 
and k is an algebraic closure of k. Also q = p'^ and d = q[q — l)/2. The 
letters X and Y denote indeterminates, and (in situations where k is present) 
the letters t,u,v,w,x, z denote elements of an extension of k which are 
transcendental over k. 





with q odd and m a divisor of {q + l)/2; or 




with q even and m a divisor of q-\-l with m ^ q -\- 1. 
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2. Group theory 

In this section we determine the possibihties for ramification in the exten- 
sion k{x) / k{f (x)) , where f{X) G k[X] is a polynomial of degree q{q — l)/2 
whose arithmetic monodromy group A has a transitive normal subgroup iso- 
morphic to PSL2(q') (with q being a power of char(fc)). We denote the Galois 
closure of the extension k{x)/k{f{x)) by E, and write qe for its genus. Then 
the geometric monodromy group of / is G = Gal{E / k{f {x))) , and we let 
Gi = G3l{E/k{x)) denote a one-point stabilizer of the permutation group G. 
Recall that, if G is either PSL2(g) or PGL2(g), then a Borel subgroup of 
G is any subgroup conjugate to the subgroup of upper-triangular matrices. 
We often use without comment the various elementary group theoretic facts 
collected in the Appendix. 

Theorem 2.1. Let k be a field of characteristic p > 0, and let f{X) G 
k[X] \ k[X^] have degree d = q{q — l)/2 where q = ]f . If A has a transitive 
normal subgroup L isomorphic to PSL2(g), then all of the following hold 
unless q, G, Gi are listed in Table A: 

(i) either G = PGL2(g) or both G = PSL2(g) andq = 3 (mod 4); 

(ii) GiCiL is a dihedral group of order 2{q+l)/o, where o = gcd(2, q—1); 
also q > 4; 

(iii) the inertia group of a place of E lying over the infinite place of 
k{f{x)) is a Borel subgroup I of G; the higher ramification groups 
of this place satisfy V := Ii = I2 = ■ ■ ■ = In ^ In+i = 1- 

(iv) E/k{f{x)) has at most two finite branchpoints (i.e., ramified finite 
places of k{ f{x))); the possibilities are: 

• One finite branch point, whose inertia group is cyclic of order 
\G : L\{q + \) / {on) where n \ ((q -|- l)/gcd(4, g -|- 1)) and n < 
q + 1, and Qe = (q - l)(n - l)/2. 

• No finite branch points, where q = (mod 4) and n = q + 1 
and QE = {q^ - g)/2. 

• One fi,nite branch point, with inertia group of order two and 
second ramification group trivial, where q = (mod 4) and 
n = 1 and gE = {q^ — 9)/2. 

• Two finite branch points, both with inertia groups of order two, 
of which precisely one is contained in L; here q = I (mod 2) 
and n = 1, and also G = PGL2(g) and gE = {q^ — q)/"^- 

q G Gi 

4 PrL2(g) C5 ^ Ca 

11 PSL2(g) Ai 

11 PGL2(g) 54 

23 PSL2(q) ^4 

59 PSL2(g) 

Table A 
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In this paper we will determine all polynomials having either the first or 
second ramification possibilities (as well as all polynomials corresponding to 
the situations in Table A). We will determine the polynomials in the third 
and fourth possibilities in the papers [H] and [20j . respectively, and in the 
latter paper we will also determine all polynomials of other degrees whose 
arithmetic monodromy group has a transitive normal subgroup isomorphic 
to PSL2(g'). We will prove in this paper that the fourth possibility does 
not yield any exceptional polynomials, or any indecomposable polynomials 
that decompose over an extension field. However, it turns out that the third 
possibility does yield exceptional polynomials. At the end of this section 
we include a result giving more details about this possibility, which we will 
need in [19] . 

The remainder of this section is devoted to the proof of Theorem 12.11 
First, since L < A < S^, we must have | PSL2(g)| < 15^1, so g > 4. Next we 
show that L < G. li L ^ G then (since G < A) the group L n G is a proper 
normal subgroup of the simple group L, and hence is trivial. Since L and 
G normalize one another and intersect trivially, they must commute. Recall 
that the centralizer in Sd of any transitive subgroup has order at most d [9l 
Thm. 4.2A]. But we have shown that the centralizer of G has order at least 
\L\ > d, contradiction. Thus L < G. 

We now describe the group-theoretic constraints implied by the hypothe- 
ses of Theorem 12. li The transitive subgroup G < satisfies PSL2((?) = 
L < G, and Gi is a point-stabilizer of G. We can identify the permutation 
representation of G with the action of G on the set of left cosets of Gi in G. 
Thus, our hypothesis of transitivity of L says that LGi = G. 

We use valuation theory to describe the further group-theoretic condi- 
tions. We identify the places of k{f{x)) with k U {cxd}, and we say that 
an element of U {oo} is a branch point of / if the corresponding place is 
ramified in E/k{f{x)). For a place Q of k{f{x)), let P be a place of E lying 
over Q, and denote the ramification groups of P/Q by Io{Q), hiQ), ■■■■ 
Different choices of P yield conjugate ramification groups; this ambiguity is 
irrelevant in what follows. We use the following standard properties of these 
groups: 

• each li is normal in Iq; 

• Ji is the (unique) Sylow p-subgroup of Iq; 

• lo/h is cyclic; 

• Jj = 1 for all sufficiently large i. 

These properties imply that Ii is the semidirect product of Iq by a cyclic 
group of order |/o : Moreover, since oo is totally ramified in k{x)/k{f{x)), 
we have Io(oo)Gi = G. We write / = Iq{oo) and V = /i(oo). 

By combining the Riemann-Hurwitz genus formula with Hilbert's differ- 
ent formula [36|, Prop. IV. 4], we can express the genus gE in terms of the 
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ramification groups: 



2gE-2 = -2d+Y, \G:hm Y.^\hm - 1). 



Q i>0 



By combining this formula witli the analogous one for the extension E/k{x), 
we obtain a formula for the (non-Galois) extension k{x)/k{f{x)). We need 
some notation to state this formula. For a subgroup H of G, let orb(-ff) be 
the number of orbits of H, and let oih'{H) be the number of orbits with 
length coprime to p. Define the index of Q to be 



which comes from the relation between the different exponent and ramifica- 
tion index [36, Prop. III. 13]. 

Our first lemma shows that G is contained in the automorphism group 
PTL2{q) of L (see the appendix for information about this group); we si- 
multaneously prove that GiD L usually has the desired shape. 

Lemma 2.2. G is contained in FTL2{q) . Also, except for the final four cases 
listed in Table A, the group Li := Gif] L is dihedral of order 2{q + l)/o. 

Proof. As noted above, we have g > 4. Since = |G:Gi| = d, the 

order of Li is 2{q + l)/o. This numerical information severely limits the 
possibilities for Li; from Dickson's classification of subgroups of L (Theo- 
rem 123]), it follows that Li has the desired shape except possibly if Li is 
one of the following groups: A^ if q = 11; S4 if q = 23; A^ if q = 59. In any 
case, Li = Nl{Li) (since L is simple and Li is maximal unless q = 4,7,9, 
or 11, and these special cases are easily handled). Hence Gi = Ng{Li). 
Since Gg{L) is a normal subgroup of G contained in Gi, it must be trivial, 
so indeed G embeds in the automorphism group Wlj2{q) of L. Finally, the 
three exceptional possibilities for Li occur with q prime, so G is either L or 
PGL2(g), and when Li is 5*4 or A^ we cannot have G = PGL2(g) since there 
is no Gi < G with \Gi : Li| = 2. □ 

Henceforth assume g, G, Gi do not satisfy any of the final four possibilities 
in Table A, and write Li := Gi H L. Then Lemma I A . 5 1 say s that our action 
of G (on the set of left cosets of Gi in G) is uniquely determined (up to 
equivalence) by G and g, and does not depend on the specific choice of Gi. 




Then our 'Riemann-Hurwitz' formula for k{x)/k{f{x)) is 




Q 



We also use the inequality 



indQ >d-ovh'{Io{Q)), 
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Lemma 2.3. I is a Borel subgroup of L or of PGL2((j'), unless q,G,Gi are 
listed in Table A. 

Proof. We first show that F is a Sylow p-subgroup of L if q > 4. If e < 2 then 
PTlj2{q) / L has order coprime to p, so V is contained in a Sylow p-subgroup 
of L; but this Sylow subgroup has order q, which implies the claim since 
q \ \V\. Now assume e > 3 and q ^ 64. Then Zsigmondy's theorem implies 
p*^ — 1 has a primitive prime divisor s. Here s is coprime to 2e, and hence to 
I PrL2(g) : L\, so any // G I of order s must lie in L. Now, /j, acts on V H L 
by conjugation, with the identity element as a fixed point, and every other 
orbit having size s (since the centralizer in L of an order-p element of L is 
a Sylow p-subgroup of L, and hence does not contain /i). Thus |y n L| = 1 
(mod s); since also \V D L\ divides q, primitivity of s implies that \V D L\ 
is either 1 or g. We cannot have |y n L| = 1, since in this case V would 
embed in PrL2(g)/L, but the order eo of this group is not divisible by qo/2. 
Hence V is a p-group containing a Sylow p-subgroup of L; after replacing 
/ by a suitable conjugate, we may assume that V Ci L consists of upper- 
triangular matrices, and that V is generated hy V Ci L and a group of field 
automorphisms. The conjugated fi still lies in / n L (since L is normal in 
PrL2(g)), and must be upper-triangular (since it normalizes V Ci L), so it 
does not commute with any nontrivial field automorphism (by primitivity). 
Thus, as above, |F| = 1 (mod s), so primitivity implies \V\ is a power of q. 
But I PrL2(g') : L\ = eo is less than q, so F is a Sylow p-subgroup of L. This 
conclusion is also true for q = 64, as can be shown by a similar argument 
using an order-21 element of / (which must lie in L). 

Now, for g > 4, we may conjugate to assume V consists of upper triangular 
matrices. Then the normalizer A?^ of ^ in PrL2(g) is the semidirect product 
of the group of all upper triangular matrices with the group of field auto- 
morphisms. Consider an element u G N whose image in PrL2(g)/PGL2(g) 
has order r; then the order of u divides rp^q^/"^ — 1). Since / is generated 
by V and an element v of order divisible by {q — l)/o, and I < N, for this 
1/ we have either r = 1 or q = 9. If r = 1 then indeed / is a Borel subgroup 
of either L or PGL2((j'). If g = 9 and r > 1 then the above divisibility 
relations imply |/| = 36, so the conditions IGi = G and |G: Gi| =36 imply 
/ n Gi = 1; but one can check that there are no such G and Gi. 

Finally, for g = 4, we have PGL2((?) = and PrL2(g) = 5*5, and one 
easily checks that, if / is not a Borel subgroup of L, we must have G = 
Wlj2{q) and I = Cq, with Gi being the normalizer in 5*5 of a dihedral 
group of order 10. □ 

Henceforth we assume q, G, Gi are not among the triples listed in Table A. 
An immediate consequence of this lemma is the structure of the higher ram- 
ification groups over the infinite place, as described in (iii) of Theorem 12. II 
recall that the chain I > V > 12(00) > 13(00) > . . . is such that every 
/i(oo) is normal in /, and /i(oo) = 1 for some i. In our case V{= /i(oo)) is 
a minimal normal subgroup of /, so every nontrivial /i(oo) equals V; hence 
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there is some n > 1 for which V = /i(oo) = 12(00) = ••• = /„(oo) but 
/„+i(oo) = 1. 

We complete the proof of Theorem 12.11 by analyzing the possibilities for 
the various other chains of ramification groups in light of the Riemann- 
Hurwitz formula. We do this in four cases. 

2.1. The case q = 3 (mod 4) and I < L. First we compute the number 
of fixed points for various types of elements of PTL2{q) in the action under 
consideration. We will use these computations to determine the number and 
length of the orbits of cyclic subgroups of PTlj2{q), which control the indices 
of finite branch points for the extension k{x) / k{f {x)) . 

Lemma 2.4. Let v G Y'Tlj2{q) have order r > 1. For v £ L: if r = 2 

then V has {q + 3)/2 fixed points; if r divides p{q — l)/2 then v has no fixed 
points; if r > 2 and r divides {q + l)/2 then v has one fixed point. If u is a 
field automorphism then it has (gg — qo)/2 fixed points, where qo = q^l''' . An 
involution in PGL2(g) \ L has {q — l)/2 fixed points. 

Proof. Since all {q^ — q)/2 involutions of L are conjugate, and the centralizer 
in L of any such involution is dihedral of order q + 1, we can identify the 
action of L on cosets of Li with the conjugation action of L on the involutions 
of L. Then the uniqueness of the action of G on cosets of Gi implies that 
that action is equivalent to the conjugation action of G on the involutions of 
L, so we examine the latter action. Thus, the number of fixed points of an 
element v £ G equals the number of involutions of L which commute with 
v. 

If € L is an involution, then its centralizer in L is dihedral of order q+l, 
and so contains {q + 3)/2 involutions. Conversely, if the order of G L does 
not divide ^ + 1, then u cannot lie in the centralizer of any involution of L. 
li V £ L has order r > 2, where r divides (g + l)/2, then the normalizer of 
{u) in L is dihedral of order 5 + 1, so the centralizer of v in L contains a 
unique involution. The centralizer in L of an involution of PGL2(g) \ L is 
dihedral of order g— 1, and so contains {q—l)/2 involutions. Finally, suppose 
V € PrL2((7) is a field automorphism of order r, and let go = Q^^'' ] then the 
centralizer of in L is PSL2((7o)) which contains {q^ — qo)/2 involutions. □ 

We compute indoo = (d — 1) + n{q — 1). For any Q e k, if Io{Q) / 1 
then Io{Q) contains an element of prime order r; by Lang's theorem, 
this element is either in PGh2{q) or is conjugate to a field automorphism. 
If v is an involution of L, then indQ > d — orb'(/o((5)) > d — ovh' {{v)) = 
(d— ((7+3)/2)/2. If G L is not an involution, then likewise ind Q ^ d—{d/r) 
if d I {q- 1), and indQ > d - 1 - (d - l)/r if r | (g + 1), and iudQ > d if 
r = p. li V is an involution in PGL2((7) \ L then indQ > [d — {q — l)/2)/2. 
Finally, if z/ is a field automorphism then indQ >d — s — {d — s)/r, where 
s = (qq — go)/2 and qQ = q; moreover, if the field automorphism has order p 
then indQ > d — s. In any case, we conclude that indQ > {d— {q + 2>) /2) /2. 
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If there are no finite branch points, then (d — 1) + n(q — 1) = 2d — 2, so 
q — 1 I d — 1 which is absurd; hence there is at least one finite branch point. 
If there are at least two finite branch points, then 

(d - 1) + n{q -l) + Y,mdQ>{d-l) + {q-l) + {d-{q + 3)/2) > 2d - 2, 
Q 

contrary to the Riemann-Hurwitz formula. Hence there is exactly one finite 
branch point Q. Similarly, the Riemann-Hurwitz formula would be violated 
if Io{Q) contained an element of order p; thus, pf |/o(Q)|. 

Now we use another geometric fact — equivalently, we add another condi- 
tion to the list of group theoretic restrictions. Consider the field extension 

/E^: it is unramified over the infinite place of E^ (since L contains all 
conjugates of /), so it is ramified over at most the single place Q of E'^, and 
the ramification over that place is tame. Since any nontrivial tame extension 
of E'-' = k{f{x)) ramifies over at least two places, we must have L = G. 

Next we consider the extension E/E^^, which is Galois with group di- 
hedral of order q + 1] here E^^ = k{x) has genus zero. This extension is 
unramified over the infinite place of E^^ (since gcd(|Li|, |/|) = 1), so all 
ramification occurs over places of k{x) lying over Q. Let H be the cyclic 
subgroup of Li of order {q + l)/2; then E^/E^^ has de gree 2 and ramifies 
only over places of k{x) lying over Q. But E^/E^^ is a nontrivial extension 
of k{x), so it is ramified, whence the ramification index of Q (in E/E'^) is 
even. 

Once again considering the extension E/E^ , we have shown that there is 
exactly one finite branch point Q, which is tamely ramified of even index. 
In particular, the inertia group Iq{Q) is cyclic of order 2s, where p \ s. 
Since Iq{Q) < L, by Theorem lA.ll we have s \ {q + l)/4. By Lemma 12.4^ 
Io{Q) has {d — {q + 3)/2)/(2s) orbits of length 2s; if s = 1 then the other 
points are fixed, while if s > 1 then only one point is fixed and Io{Q) has 
{q + l)/(2s) orbits of length s. In any case, indQ = d — 1 — {q'^ — l)/(4s). 
From 2d — 2 = {d—1) +n{q — 1) + indQ we conclude that n = {q + l)/(4s). 

Now we compute the genus of E, using the Riemann-Hurwitz formula for 
the extension E/ E'~': namely, 2gE — 2 equals 

-2\G\ + \G:m\I\ - l)+n{\V\ - 1)) + |G: /o(Q)|(2s - 1) 

= -q) + {q + l) -l + n{q- 1)) + ^(2. " 1); 

simplifying, we find that gE = (n— l){q — l)/2. 

This concludes the proof of Theorem 12.11 in this case. 

2.2. The case q = 3 (mod 4) and I ^ L. Here / is a Borel subgroup of 
PGL2(g), so G contains PGL2(g). As above, we compute indoo = d — 1 + 
n{q — l)/2, and each finite branch point Q satisfies ind Q > (d — (g + 3)/2)/2; 
hence there are at most two finite branch points. 
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If there are two finite branch points Qi and Q2 then 

d-l + n(g-l)/2 + ^indQ > d - 1 + {q - l)/2 + {d - (q + 3)/2) =2d-3, 
Q 

so we must have n = 1, and the indices indQi and ind(52 must be (in some 
order) (d— (g+3)/2)/2 and {d—{q—l)/2)/2. The inequahties for indQ in the 
previous subsection imply that /o(Qi) and Io{Q2) are 2-groups containing 
no involutions outside PGL2(9). Since these two inertia groups have order 
coprime to p, they are cyclic, so they must have order 2 (otherwise mdQj 
would be too large). Assuming without loss that indQi < indQ2j it follows 
that Iq{Qi) is generated by an involution in L and Iq{Q2) is generated by an 
involution in PGL2(g) \ L. The subgroup of G generated by the conjugates 
of /o(gi) and Jo ((32) is PGL2(g), so ^PGL2(g)/^G 

is an unramified extension 
of k{f{x)), and thus is trivial: G = PGL2((j'). Now we compute the genus 
oiE: 

2gE-2 = -2(g3 _ g) + (5 + i)(g2 _ g _ 1 + ^ _ 1) + (^3 _ 

so gE = {q^ - q)/2. 

Henceforth assume there is at most one finite branch point Q. The same 
argument as in the previous subsection shows there must be at least one such 
Q, and it must be tamely ramified. Consider the extension E^'^^^^'^^ / . 
This extension is unramified over the infinite place of k{f{x)) (since PGL2{q) 
contains all conjugates of /), so it can only be ramified over Q; hence it is 
a tamely ramified extension of k(f{x)) which is ramified over less than two 
points, so it is trivial: G = PGL2(g). Thus E^/E'^ has degree 2, so it is 
a tame extension of E^ = k{f{x)), whence it must be ramified over both 
infinity and Q; hence Io{Q) is cyclic of order 2s and is not contained in 
L. It follows that 2s divides either g — 1 or g + 1. In the former case, a 
Riemann-Hurwitz computation shows that n = 1 and s = {q — l)/2, but 
then the genus of E would be —q which is absurd. In the other case, we find 
that s must be even, n = (g + l)/(2s), and the genus of E is {q — l){n — l)/2. 
This concludes the proof of Theorem 12.11 in case q = 3 (mod 4). 

2.3. The case q = I (mod 4). First we show that BLi / L for every 
Borel subgroup B of L; this implies i? 7^ /, so / is a Borel subgroup of 
PGL2((7). For, if BLi = L, then every Borel subgroup of L has the form B'^ 
with G Li, so B'^ f] Li = (B f] LiY is trivial. But this is impossible, since 
any involution in Li is contained in some Borel subgroup of L. 

Thus, / is a Borel subgroup of PGL2(g), so G > PGL2(q'). The remainder 
of the proof in this case is similar to the proof in the previous subsection, 
so we only give the fixed point computation. 

Lemma 2.5. Let v G PrL2(q') have order r. If 1^ is a field automorphism 
then u has no fixed points if r is even, and v has {q^ — qo)/2 fixed points if 
r is odd; here qo = q^^'^ . If v ^ PGL2((?) and r > 2, then v has one fixed 
point if r \ (g + 1) and v has no fixed points if r \ p{q — 1). An involution 
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in L has {q — l)/2 fixed points; an involution in PGL2(g) \ L has {q + 3)/2 
fixed points. 

The proof of this lemma is similar to the proof of Lemma \2A\ except that 
in this case we identify the action of G on cosets of Gi with the conjugation 
action of G on the involutions in FGh2{q) \ L. 

2.4. The case p = 2. Here PGL2{q) = L, so we identify these groups. 
In particular, / is a Borel subgroup of L. We begin with a fixed point 
calculation. 

Lemma 2.6. An involution of L has q/2 fixed points; an element of L of 
order r > 1 has no fixed points if r \ q—1, and one fixed point if r \ q + 1. A 
field automorphism of order r has no fixed points ifr = 2, and has {qQ — qQ)/2 
fixed points if r is an odd prime; here qo = q^^^ . 

Proof. Since there are {q'^ — q)/2 dihedral subgroups of L of order 2{q + 1), 
and they are all conjugate, the number of fixed points of an element v £ L 
(acting on cosets of Li in L) equals the number of dihedral subgroups of L 
of order 2{q + 1) which contain v. This number is certainly zero if the order 
r > 1 oi v does not divide 2(q + 1), which happens if r | q — 1. Next, a 
dihedral group of order 2{q + 1) normalizes each of its cyclic subgroups of 
order dividing q + 1; since the normalizer in L of a nontrivial cyclic group of 
order dividing (7 + 1 is dihedral of order 2(q' + 1), it follows that a nonidentity 
element of L of order dividing q + 1 has exactly one fixed point. 

Next consider a field automorphism a of order 2. Let G be the group 
generated by L and a, so |G:L| = 2. Suppose that a has a fixed point; 
then a lies in some point-stabilizer Gi < G. Here Li := GiD L is dihedral 
of order 2{q + 1), and Gi is the normalizer of Li in G. In particular, a 
normalizes the cyclic subgroup of Li of order q + 1; let be a generator of 
this subgroup. Let fl G GL2(g) be a preimage of /j. under the natural map 
GL2(g) — > L. Then fi has distinct eigenvalues, and the eigenvalues of afia^^ 
are the y^-th powers of the eigenvalues of /i, so afia~^ is conjugate to /i^. 
Thus, afia~^ is conjugate to /xv^ in L. Since the normalizer of in L is Li, 
the only powers of fj, which are conjugate (in L) to are It follows 

that afia~^ is one of /i^v^. A Sylow 2-subgroup of Gi which contains a 
also contains an involution r G Li, and so must be dihedral of order 4; thus 
(cjr)^ = 1. But, since r/ir = ^u"^, we have fi = (ar)'^ iJ,{aT)~'^ = fi'^ = fi~^, 
which is a contradiction, so in fact a has no fixed points. 

For the remaining cases, we use the following elementary result about 
fixed points in a permutation group. Let Gi be a subgroup of the finite 
group G, and consider the natural action of G on the set of cosets of Gi 
in G. For an element 1^ G G, let i'i,i'2, ■ ■ ■ ,t^s be representatives of the 
conjugacy classes of Gi which are contained in the conjugacy class of u in 
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G. Then the number of fixed points of v is 

s 
i=l 

We first apply this in case G L is an invohition; let G = L and let 
Gi = Li be dihedral of order 2{q + 1). Then the conjugacy class of in L 
consists of all involutions in L, and Cl{i^) is a Sylow 2-subgroup of L; all 
involutions in a dihedral group of order 2{q + 1) are conjugate, and each 
generates its own centralizer. By the above fixed point formula, u fixes q/2 
cosets of Li in L. 

For the final case in the lemma, let a G PrL2(g) be a field automorphism 
of order r, and assume that r is an odd prime. Write q = Qq- Let G be the 
group generated by L and a, so |G : L| = r. Let iJ be a cyclic subgroup of 
PSL2((/o) of order qo + 1, and let Li (respectively, Gi) be the normalizer of 
H in L (respectively, G). Then Li is dihedral of order 2{q + 1), so Gi is 
generated by Li and a and has order 2r{q + 1). The centralizer of a in Gi 
is generated by a and PSL2(go) H Gi; since the latter group is dihedral of 
order 2{qo + 1), the order of the centralizer is 2r{qo + 1). The centralizer of 
(7 in G is generated by a and PSL2((?o)) and has order r{qQ — qo). We will 
show that the conjugacy class of a in G contains a unique conjugacy class of 
Gi; by the fixed point formula, it follows that a has {q^ — qQ)/2 fixed points. 

Since a normalizes L, any conjugate of cr in G has the form jia with 
/X G L; conversely, by Lang's theorem, if /la has order r (where G L) then 
is conjugate to cr in G. If r \ q + I then a generates a Sylow subgroup 
of Gi, so it is conjugate in Gi to any element na of order r with G Li. 
Henceforth assume r \ q + 1. Let J be a Sylow r-subgroup of Li containing 
a. Then J := Jfl L is a Sylow r-subgroup of Li, so it is cyclic of order (say) 
r^; let r be a generator of J. Since a normalizes J, we have aTa~^ = 
where 1 < i < . Then = a'^Ta~'^ = t, so = 1 (mod r^), whence 
i = 1 (mod r^~^). Since q + 1 = qg + 1 is divisible by r, also r \ qo + I, 
and thus (q + l)/{qo + 1) is divisible by r but not by r^. Hence a does 
not centralize J, so z > 1. Next, we compute (r^'cr)'" = ^\ so 

r"(j has order r if and only if divides a(l + i + ■ ■ ■ + P^^), i.e., if and 
only if r^~^ \ a. Conversely, if r^~^ \ a then a = b{i — 1) (mod r^); since 
T~^aT^ = r''(*~^V, it follows that J contains a unique conjugacy class of 
subgroups of order r which are not contained in L. Thus Gi contains a 
unique conjugacy class of subgroups of order r which are not contained in 
L, and the proof is complete. □ 

This computation implies that the index of any branch point Q satisfies 

indQ > 2d/3-q/2. Since indoo = d-l + n{q/2-l) > d-2 + q/2, it follows 
that there is at most one finite branch point Q, and indQ < d — {q/2). 

Since G/L is cyclic, there is a unique group H between L and G such that 
|iy : L| is the highest power of 2 dividing |G : L|. Then /E'^ is unramified 
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over infinity, so it is a tame extension of k{f{x)) liaving only one brancli 
point, wlience it is trivial. Thus H = G, so if G ^ L then \G : L\ is a power 
of 2. Now assume s := \G : L\ is a power of 2. Since G is generated by the 
inertia groups, which are conjugates of I and Io{Q), it follows that Io{Q) 
maps onto G/L; let v G loiQ) map to a generator of G/L. Replacing u 
by an odd power of itself, we may assume fi has order a power of 2. Since 
indQ < d — {q/2), v must have at least q/2 fixed points; hence v cannot be 
conjugate to a field automorphism, so {v) intersects L nontrivially. Since 
4 1 |Li|, a subgroup of L of order divisible by 4 has no fixed points; thus 
4 t l-^o(Q) n L|. Hence the Sylow 2-subgroup Ii{Q) of Io{Q) has order 2s, 
so it is generated by v. Since the involution in Ii{Q) H L is centralized by 
Iq{Q) n L, the latter group has order a power of 2; hence Io{Q) = hiQ)- 
By Lemma [3.8| hiQ) /hiQ) is elementary abelian. Since Ii{Q) is cyclic 
of order 2s, the order of hiQ) is either e or 2e, so |/2(Q)| > 1- Thus, for 

< i < 2, the group Ii{Q) contains an involution of L, so orb(/j((5)) < (7^/4. 
But then we have the contradiction 

2 

indQ > Y.{d-orh{Ii{Q)))/\Io{Q):hm 

1=0 

> (d - q^/4) + {d- q^A) + (d - q^ 1^)12 >d- q/2. 

Henceforth we assume G = L. 

Suppose the ramification over Q is wild. If h{Q) has a subgroup of order 
4 then every orbit of h{Q) has even length, so ind Q > d is too large. Hence 
the Sylow 2-subgroup h{Q) of Io{Q) has order 2, so it is centralized by h{Q)] 
but the centralizer (in L) of an involution is the Sylow subgroup containing 
the involution, so Io{Q) has order 2. A Riemann-Hurwitz calculation yields 
hiQ) = 1 and n = 1. In this case the genus of E is {q^ — q)/2. 

Now suppose the ramification over Q is tame. Then hiQ) is cyclic of 
order s, where s divides either q — 1 or q + 1. Ifs>l and s \ q — 1 then 
indQ = d — d/s, which implies that n = 1 and s = q — 1; but then the genus 

01 E would be —q, which is absurd. Thus s | q+l, so indQ = d— 1 — (d— l)/s, 
whence n = iq+1)/ s. Here the genus ofE'is (g— l)(n — 1)/2. This completes 
the proof of Theorem 12. 1[ 

2.5. Preliminary analysis in the case of two wildly ramified branch 
points. We now prove the following result, which will be used in |19j : 

Lemma 2.7. Let k be a field of characteristic 2, and let q = 2^ with e > 1. 
Let f £ k[X] \ k[X'^] have degree qiq — l)/2, let E be the Galois closure 
of kix) / kif ix)) , and let I be the algebraic closure of k in E. Suppose that 
GaliE/lifix))) = PGh2iq) and A:(x)/A;(/(x)) is wildly ramified over at least 
two places of kif ix)). Then E / lif ix)) has precisely two ramified places, both 
of degree one, and the corresponding inertia groups are ( up to conjugacy ) the 
order-2 group generated by (J i) ^'^'^ the group of upper-triangular matrices 
in PGL2((/). Moreover, the second ramification group over each ramified 
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place is trivial. The degree [I : k] divides e, and f is indecomposable. Here f 
is exceptional if and only if e is odd and [i:k] = e. Finally, there is a curve 
Cq over k such that i.k{CQ) =e E. 

Proof. The facts about ramification follow from Theorem 12. H using the fact 
that PGL2(g) contains a unique conjugacy class of involutions (Lemma lA.Sp . 
Write u := f{x), and let A := Gal{E/k{u)) and G := Gal{E/i{u)) and 
Gi := Gal{E/i{x)). Theorem 12.11 implies Gi is dihedral of order 2{q + 1), 
so Gi is maximal in G. Pick f G Ca{G). The subfield of E fixed by G.{v) 
is r(n). Since Gal(£(a;)/r(x)) ^ G&\{i{u) / 1 {u)) ^ Gal(^/r), it follows 
that Ga\.{E / (.'^ {x)) contains an element iiv with fj, € G. Since i{x)/i'^{x) is 
Galois, fiu normalizes Gi; but since commutes with Gi, this means that // 
normalizes Gi, whence £ Gi (since G is simple and Gi is maximal in G). 
Hence Gal{E / i'^ (x)) contains u, so E'^ contains (.^{x). Since v commutes 
with G, the group {v) is a normal subgroup of so E^ /P^{u) is Galois. 

But E is the splitting field of f{X) — u over so it is also the splitting 
field of f{X) — u over i'^{u), whence it is the minimal Galois extension of 
r(u) which contains r(x). Thus E = E'' , so = 1. 

We have shown that Ga_{G) = 1, so the action of A on G by conjugation 
is faithful, whence A ^ Aut(G) ^ PTLalg). In particular, [£:k] = \A:G\ 
divides |PrL2(g): PGL2((?)| = e. Next, / is indecomposable over i, since 
Gi is a maximal subgroup of G. The existence of a curve Cq over k with 
£.A;(Co) =e E follows from the fact that A is the semidirect product of G 
with a group H of field automorphisms: for £^ = k and \H\ = \ Gal(£/A;)|, 
so £.E" = E. 

Finally, we address exceptionality. By [3, Lemma 6] (or [23^ Lemma 4.3]), 
/ is exceptional if and only if every element of A which generates A/G has 
a unique fixed point. By Theorem 12. H Gi is dihedral of order 2{q + 1); by 
Lemma lA. 21 Gi is the normalizer of its unique subgroup of order 3, and G 
has a unique conjugacy class of order-3 subgroups. Thus we can identify 
the set of cosets of Gi in G with the set of order-3 subgroups of G, and the 
action of G on cosets of Gi corresponds to its action by conjugation on these 
subgroups. Moreover, the natural action of A on the order-3 subgroups of 
G induces the permutation action of A under consideration. 

Every coset in A/G has the form aG where a S FTL2{q) is a field auto- 
morphism. If a has order e/e' , then the centralizer of o" in G is PGL2(2'^ ), 
which contains 2'^'~^(2*^' — 1) subgroups of order 3. In particular, if e' > 1 
then cr fixes more than one order-3 subgroup; thus, if / is exceptional then 
A = FTh2{q). Moreover, Theorem 11.21 implies that e must be odd if / is 
exceptional. 

Conversely, suppose A = FTL2{q) and e is odd. To prove / is exceptional, 
we must show that every element of A which generates A/G has precisely 
one fixed point. By an easy counting argument [14^ Lemma 13.1], it suffices 
to show that there is a generating coset of A/G in which every element 
has at most one fixed point. Pick an element u G A which induces the 
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Frobenius automorphism on AjG = Gal(Fq/F2). Since A/G has odd order, 
u'^ also generates A/G, and moreover if has at most one fixed point then 
so does u. By replacing v hy u'^ , where s is sufficiently large and 2^ = 1 
(mod e), we may assume that u has odd order; thus, if normalizes an 
order-3 subgroup then it centralizes the subgroup. By Lang's theorem on 
algebraic groups, there exists r G PGL2(Fq) such that tut~^ is the Frobenius 
automorphism a in PrL2(Fq). Thus Cg{v) is isomorphic to a subgroup of 
^PGL2(Fg)('^) — PGL2(2), which contains a unique order-3 subgroup. □ 

The following consequence of Lemma 12.71 describes the ramification in 
C — > C/B, where C = CqX/^I and B is the group of upper-triangular matrices 
in L. Here W = BO PGL2(2) and T is the group of diagonal matrices in B. 

Corollary 2.8. IfC is a curve over I for which i(C) = E, then the following 
hold: 

(i) B acts as a group of £- automorphisms on C; 

(ii) the quotient curve C/B has genus zero; 

(iii) the cover C ^ C/B has exactly three branch points; 

(iv) the inertia groups over these branch points are B, T, and W (up to 
conjugacy); and 

(v) all second ramification groups in the cover C C/B are trivial. 

Proof. We know that E/l{f{x)) is Galois with group L, and is ramified over 
precisely two places, both of which have degree one and have trivial second 
ramification group, and moreover the inertia groups are B and W . Thus 
there is an action of L as a group of ^-automorphisms of C for which the 
cover C ^ C/L has this same ramification. By Riemann-Hurwitz, the genus 
of C is — l)/2. Since the second ramification groups m C ^ C/L are 
trivial, it follows that the same is true m. C ^ C/B. 

Let Pi and P2 be points of C whose inertia groups m. C ^ C/L are B 
and W, and let Qi and Q2 be the points of C/L lying under Pi and P2. 
Then each of the g + 1 points of C lying over Qi has inertia group conjugate 
to B. Since B is self-normalizing in L, and the intersection of any two 
conjugates of B is cyclic of order (7 — 1, it follows that the inertia group of 
Pi in C ^ C/B is P, while the inertia groups of the other q points over Qi 
are cyclic of order q — I. Since B has q cyclic subgroups of order g — 1, and 
they are all conjugate in P, it follows that Qi lies under two branch points 
of C ^ C/P, and the corresponding inertia groups are P and T. Since all 
involutions in L are conjugate, and each has normalizer of order g, each 
of the — 1 involutions in P occurs as the inertia group of precisely q/2 
points of C lying over Q2. Thus Q2 lies under q{q — l)/2 points of C which 
ramify in C ^ C/P, and all these points lie over the same point of C/B. 
Hence C C/B has precisely three branch points, with inertia groups P, 
T, and W; now Riemann-Hurwitz implies that C/B has genus zero, which 
completes the proof. □ 
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3. Characterizing certain field extensions by ramification 

In this section we study the extensions E/k[z) having certain ramifica- 
tion; the specific choice of ramification configuration comes from our desired 
apphcation to the classification of degree q{q — l) j1 polynomials having mon- 
odromy group normalizing PSL2((7). However, the results in this section are 
of interest for their own sake, as they provide data for the general problem 
of determining the ramification possibilities for covers of curves having spec- 
ified monodromy group. The goal of this section is to prove Theorem 11.51 of 
the introduction. 

We begin with three easy facts about elementary abelian field extensions; 
a convenient reference for these is [15]. The first result describes the shape 
of these extension fields [T5] Prop. 1.1]. 

Lemma 3.1. Let E/F he an elementary abelian extension of degree , 
where F^e C F . Then there exist elements v £ E and z £ F such that 
E = F{v) and the minimal polynomial of v over F is T^" —T — z. 

The converse of this result also holds [151 Prop. 1.2]. 

Lemma 3.2. Pick z £ F, and suppose that ¥pe C F and that the polynomial 
T^" —T — z £ F[T] is irreducible over F. For any root v of this polynomial, 
the extension F[v)/F is elementary abelian of degree . The map a ^ 
a{v) — V is an isomorphism between Gal(F(f)/F) and the additive group of 
Fpe . The intermediate fields F C Fq CI F{v) with [Fq : F] = p are precisely 
the fields Fq = F{v(), where for ( £ F*e we put 

:= iCvf-' + {Cvf'-' + ... + {Cvf + iCv). 
The minimal polynomial for over F is T^ — T — Qz. 

Note that the values are precisely the images of the various C,v under 

e — 1 

the polynomial T^ + ■ ■ ■ + TP + T, which is the trace map from Fpc to 
Fp. In order to apply this result, we need to know when the polynomial 
T^" —T—z S F[T] is irreducible; we now give criteria for this [151 Lemma 1.3]. 

Lemma 3.3. Pick z £ F , and suppose F^e C F. The following conditions 
are equivalent: 

(a) T^" — T — z is irreducible over F. 

(b) For all C £ F*e, the polynomial T^ — T — Qz is irreducible over F. 

(c) For all C £ ¥*e, the polynomial T^ — T — Qz has no roots in F. 

There are versions of these three lemmas in which the polynomial T'p" — T 
is replaced by any separable monic additive polynomial in F\T] of degree 
p'^ which has all its roots in F (cf. e.g. [IQ]). However, the statements are 
simplest in the case of — T, so we restrict to this case in what follows. 

Our next results concern the ramification in E/F. 
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Lemma 3.4. Suppose F = k{w), where k is perfect (and w is transcendental 
over k). Let E = F{v), where the minimal polynomial for v over F is 
XP —T — z (with z £ F). If E/F is unramified over each finite place of F, 
then there is some v' € E for which v' — v £ F and E = F{v'), and where 
moreover the minimal polynomial for v' over F isTP'-T-z' with z' G k[w]. 

Proof. For y G k{w) , we may replace v hy v + y and z hy z + y^" + y without 
affecting the hypotheses. Writing z = a/b with a,b £ k[w] coprime, we may 
thus assume that y (and hence z) has been chosen to minimize deg{b). We 
will show that z G k[w]. 

We begin by showing that 6 is a p^-th power in k[w]. For this, consider 
any place Q of k{w) which contains b (equivalently, any irreducible c G 
k[w] which divides b) and let P be a place of E lying over Q. Let p be 
the (additive) valuation corresponding to P, normalized so that p{E) = Z. 
Since P is unramified over Q, the value p{h) (for any h G k[w]) is just the 
multiplicity of c 3jS Si divisor of h. Thus 

p{vP' -v) = p{z) = -p{b) < 0, 

so p{v) < 0, whence p^p{v) = p{vP — v) = —p{b). Since this holds for every 
irreducible factor c of 6, we conclude that b is indeed a p'^-th power in k[w]] 
say 5 = 6q . 

For any irreducible factor c G k[w] of 6, the residue field k[w\/{c) is a 
finite extension of k, hence is perfect; thus, a is a p^-t\i power in this field. 
In other words, there is some oq G k[w] such that — a is divisible by c. 
For V := V — ao/bo, we have 

, e , a - al + ao^o 

yy — y = il ^ . 

b 

Since c divides both the numerator and denominator of the right-hand ex- 
pression, we can write v'p" —v = a/b, where a, 6 G k[w] and deg(6) < deg(6). 
But this contradicts our hypothesis that deg(6) is minimal. This implies that 
b has no irreducible factors in k[w], so b £ k*; thus z £ k[w], as desired. □ 

This result shows that, in the case of interest to us, we may assume 
z G k[w]. Our next two results describe the ramification in extensions of 
this sort. 

Lemma 3.5. Suppose F = k[w), where k is perfect. Let E = F{v), where 
the minimal polynomial of v over F is h{T) := — T — z (where z G 
A;[w]j. Then E/k{w) is unramified over each finite place of k{w). If k is 
algebraically closed in E and F^e C k, then E/k{w) is totally ramified over 
the infinite place ofk{w). 

Proof. First consider a finite place of k{w), and let S be the corresponding 
valuation ring of k{w); since h{T) G S[T] and h'{T) = —1 G S* , the place 
is unramified in the extension E/k{w). Now assume that k is algebraically 
closed in E and F^e C k. By Lemma [3^ E/k{w) is abelian, so each subgroup 
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of Gsd{E/k{w)) is normal. In particular, this applies to the inertia group 
/ of a place P oi E lying over the infinite place of k(w), so / does not 
depend on the choice of P. Thus the fixed field is an unramified Galois 
extension of k(w) in which k is algebraically closed, so it is a trivial extension; 
hence / = Gal{E/k{w)), so the infinite place of k{w) is totally ramified in 
E/k{w). □ 

Now we examine more carefully the ramification over the infinite place, by 
studying the higher ramification groups. In particular, we consider the case 
where there is only one jump in the filtration of ramification groups over the 
infinite place of k{w); this is what occurs in the situation of greatest interest 
to us, namely when z is a power of w. 

Proposition 3.6. Suppose F = k{w), where k is perfect and k 5 Fpe. Let 
E = F{v), where the minimal polynomial of v over F isTP -T - z (with 
z G fc[u)]J. Assume that no term of z has degree a positive multiple of p^ , 
and that k is algebraically closed in E. Let Iq,Ii,... be the ramification 
groups at a place of E lying over the infinite place of k{w). Then (a) and 
(b) below are equivalent, and each implies {c): 

(a) Lo = Ii = ■■■ = In but In+i = 1. 

(b) For every C, G F*e, the polynomial gotten from C,z by replacing each 

term aw^^^ by 'w^ (for integers i,j>0 with j coprime to p) has 
degree n. 

(c) n is the largest integer coprime to p which divides the degree of a 
nonconstant term of z. 

We may assume that no term of z has degree a positive multiple of p^: we 
can replace v hy v := v + y, where y G k[w] is chosen so that z := z + y^ —y 
has the desired property (such an element y exists because k is perfect), and 
then F(v) = F{v) and the minimal polynomial of v over F is T'f — T — z. 

Proof. By the previous result and Lemma 13.21 Iq = Gal{E/F) = ¥pe. 
Lemma [3. 21 describes the intermediate fields F C Fq C E for which [Fq : F] = 
p: they are the fields Fq = F{v(^) where, for ( £ F*e, we put := 

(C'^)^" ^ + (C^)^^ ^ + • • • + (C^)^ + (C^)- The minimal polynomial for 
over F is TP — T — C,z. 

First we show the equivalence of (a) and (b). We begin by relating the 
groups li to the corresponding groups for the extensions F{vi^)/F, via [361 
Prop. IV.3] (note that in the statement of that result, e^/x should be re- 
placed by ci/xi). The stated result implies that (a) is equivalent to the 
following: for each the ramification groups for F[v(^)/F over the infinite 
place of F equal Gal{F{vc_) / F) until the (n + l)-th group, which is trivial. 
Now we just need to compute the ramification groups over infinity for the 
Artin-Schreier extensions F(v(^)/F. We first normalize by replacing it by 
vq := + y(^, where y(^ G k[w] is chosen so that no nonzero monomial in 

— = (z + y^ — has degree a positive multiple of p; this is possible 
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because k is perfect. Then F{v(^) = F(v(^) and the minimal polynomial for 
over F is TP — T — z, where z is gotten from (z by replacing each term 
aw^'^ (where j is coprime to p) by the term ^w^ . The computation of 
the ramification in F(v,^)/F is classical in this case, since n := deg(z) is 
coprime to p: the first several ramification groups over infinity equal the full 
Galois group, until the (n + l)-th group which is trivial [39^ Prop. III.7.8]. 
This proves the equivalence of (a) and (b). Note that n = re is necessarily 
coprime to p. 

We now show that (b) implies (c). So, assume (b); then z has a term of 
degree np"^, and we have seen that n is coprime to p. We just need to show 
that z has no term of degree sp^ with s > n and s coprime to p. For any such 
s, write z = Y^ aiw'^ with Ui € k, and let z = OsW^ + agpW^P + agp2w'^P + ■ ■ ■ 
be the sum of the terms of z having degree sp^ . Then (b) implies that, 

for every C G F;., we have + (Ca^p)^/^ + (CospO^'^^' + • • • = 0- From 
our assumption that no term of z has degree a positive multiple of p'^, we 
see that deg(l) < sp'^'^. Thus, when we raise the previous equation to the 

power p^""*^, we get h{C) = 0, where h{T) := af T^" ^ + afp T^" ^ + . . . 
is a polynomial in k[T]. Since h{T) vanishes on Fpe, but deg(/i) < p'^~^, it 
follows that /i = 0, so each Ugpj = 0. This concludes the proof. □ 

We now show when certain data determines the field k{v, w), where v^" — 
V = tu". The data come from the extension k{v, w)/k{w'^) for some r; we are 
given the ramification groups over infinity for this extension, and also we 
are given that w)/k{w) is unramified over finite places. We will see that 
this data uniquely determines , w) if and only if n, r satisfy a certain 
arithmetic condition. 

Proposition 3.7. Let E D k{w) D F satisfy [E : k{w)] = p^ and [k{w) : F] = 
r, where k is a perfect field containing Fpe and w is transcendental over k. 
Assume that E/F is Galois and is totally ramified over some degree-one 
place of F, and that the sequence of ramification groups over this place has 
jumps only after the 0-th and n-th groups (where p\ n). Also assume that 
E/k{w) is ramified over only one place, and that r/gcd(re, r) divides p^ — 1. 
Finally, assume that either k = Fpe or p^ is the least power of p congruent 
to 1 modulo r/gcd(re, r). Then E = k(v,w) where 

(a) k(w) = k{w) and F = k{w^); 

(b) z := — V lies in k[w\ and has no nonconstant terms of degree 
divisible by p^; 

(c) n is the largest integer coprime to p which divides the degree of a 
nonconstant term of z; 

(d) E/k{w) is Galois, and the map a (^{v) — v induces an isomor- 
phism Gal{E/k{w)) Fpe; for a £ Fpe, let aa be the corresponding 
element of Gal(E/k{w)); 

(e) for T G Ga\{E/F), put C, := t{v)/v; then ( G F*e and TaaT~^ = 
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(f) every term of z has degree congruent to n mod r. 

The proof rehes on various results about ramification groups. The stan- 
dard reference for these is [361 Ch. IV]; we recall the facts we will need. 
Given a Dedekind domain S with field of fractions F, let R be its integral 
closure in a finite Galois extension E of with Galois group G. Let P be 
a prime ideal of R, and put Q = P Ci S. The decomposition group D of P is 
the subgroup of G consisting of elements a £ G with cr{P) = P. When the 
extension of residue fields {R/P)/{S/Q) is separable, the i-th ramification 
group li of G relative to P (for z > 0) is defined to be the set of a G G 
which act trivially on R/P^^^. The Ij form a decreasing sequence of normal 
subgroups of D, and Ij = 1 for i sufficiently large. Here Iq is the inertia 
group of P. By a 'jump' in the sequence of ramification groups, we mean 
an integer i > for which Jj ^ li+i- Especially important for our purposes 
are results of [36, IV. 2], which we now state (our statements differ slightly 
from those of [36j). We denote the residue field R/P by £. 

Lemma 3.8. The map 9q: Iq/Ii Auti{P/P'^) given by Oq{t): it ^(71) 
is an injective homomorphism. For i > 1, the map 9i{a): vr 1-^ o"(7r) — vr 
induces an injective homomorphism Oi: U/IiJ^i 'Kom.^{P / P"^ , P^'^^ / P^^"^) . 
For T G Iq and a € we have 6i{TaT^^) = 9o{Ty6i{a). 

Here P/P^ is a one-dimensional vector space, so Auti{P/P'^) = i*. 
Likewise ^ one-dimensional ^-vector space, so p^/p^~^^ is iso- 

morphic to Hom£(P/P^, p*+i/p*+2) via the map taking -0 to vr 1— > ipn. Thus 
the right side of the final equation in the lemma makes sense, since it is just 
the action of i* on the ^-vector space P^ /P^~^^. Finally, note that the final 
equation simply amounts to the natural action of P/P'^ on its z-th tensor 
power, which explains the i-th power in that equation. 



Proof of Proposition 3.1. Let Q be the degree-one place of F over which 
EjF is totally ramified, and let P be the place of E lying over Q. Since 
PjQ is totally ramified, the inertia group /q equals G := Gal{E/F). Since 
in addition Q has degree one, the constant fields of F, k{w), and E must 
all be the same, so they are all k. By replacing w hy l/{w — a) if necessary 
(with a € k), we may assume that P lies over the infinite place of k{w). 
Next, Ii is the unique Sylow p-subgroup of /q, so the fixed field E^^ must 
equal k{w) (since [E : k{w)] = p*^). Hence Gal{k{w)/F) = Iq/Ii is cyclic 
of order r; here (v) := Gal{k{w) / F) C Autk{k{w)), and the latter group 
is isomorphic to PGL2(fc) where (" (5) corresponds to the fc-automorphism 
of k{w) sending w i— > {aw + ^)/{(3w + 5). Since k{w)/F is totally ramified 
under the infinite place, v generates the decomposition group under this 
place, so v{w) = aw + 7; but v has order r which is coprime to p, so 
either v is the identity (and we put w = w) 01 a ^ \^ va. which case we 
put w = It; + 7/(0 — 1). In any case, there exists w G k[w\ such that 
k{w) = k{w) and v{w) = aw with a £ k a primitive r-th root of unity, so 
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F = k{wY = k{w^). This proves (a); note that E/k{w) is totally ramified 
over infinity. 

Let r E Gal{E/F) map to a generator of Ga[{k{w)/F); then r(t(;) = (^w 
where is a primitive r-th root of unity. Since P is totally ramified over the 
infinite place of k{w), and 1/w is a uniformizer for the latter place, we have 
1/w G PP" \ PP"+^. If A denotes the valuation ring of E corresponding to 
P, and TT is any uniformizer of P, then 1/w = yvr^ for some y £ A*; since 
-y&P, 

t{1/w) = r(y)r(^)P' = yr(^)P' (mod PP'+i). 

But t(1/u') = l/iCw) = C'^ynP", so T(7r)P' = C"^vrP' (mod whence 
^oi^) = C^-'^/p" G k* . Next, 9n induces an injective homomorphism Ii — > 
pn/pn+i^ and OniraT-^) = C""^n(fT) for a £ h. Iterating, e„(rVT-*) = 
C~'"^n(o'), so the image of 0„ contains all sums of elements C~*"^n('7); in 
other words, the image of 6n contains Fp(("^")^„((T), which equals ¥pe6n{a) 
by hypothesis. Choose a to be any nonidentity element of /i; then the 
image of 9n is precisely ¥pe9n{a), and we have an isomorphism from F^e to 
the image of On via a i— > a6n{(y) (unlike our previous isomorphisms, this one 
is not canonical). 

Now we use basic Galois cohomology to pick the element v. A reference 
is |36t Chs. VII and X]. We have a homomorphism p: /i — > Fpe c E, which 
is a 1-cocycle for the /i-module E. Since H^{Ii,E) = 0, the cocycle p is a 
coboundary, so there exists v € E such that, for each o" S /i, we have p{a) = 
(t(u) — V. It follows that the map a o"(u) — u is an isomorphism Ii F^e; 
we denote by ctq the preimage of a G Fpe under this map. In particular, v 
has p'^ conjugates under Ii, so indeed E = k{v,w). Also we now know the 
shape of the minimal polynomial for v over k{w): it is JloeF e (^ + '^)) ~ 
(T — vY" — {T — v) = TP" — T — z, where z := vP" — v lies in k{w). 

By Lemma 13.41 and the remark following Proposition 13.61 there exists 
v' E E such that v' — v £ k{w) and z' := v'^ — v' lies in k[w\ but z' has no 
terms of degree a positive multiple of p*^. Note that v' is only determined up 
to addition by an element of k] eventually we will specify the choice of this 
element to determine v. Regardless of the choice, we have k{v' ,w) = k{v, w) 
and aaiv') — v' = a; (b) and (d) follow at once, and (c) then follows from 
Proposition 13.61 

Let r S Gal(-E/F) map w i— > (w, where C has order r. Since 6n{T^o'aT~'^) = 
C~*"^n(ca), injectivity of 6n yields T^aaT~'^ = c7„^-in; since every element of 
Gal(£'/F) has the form tVq,, this proves (e). 

Finally, we consider (f), and specify the choice of v £ v' + k. For r as in 
the previous paragraph, we have 

aC~^ = o-a(-n{v') — v' = TaaT~^{v') — V = T{aaT~^{v') — T^'^{v')); 

since r fixes aC~"> it follows that aC~" = aaT~^{v') — t~^{v'). But also 
aC""" = CTaiC'^v') — C"""!"', so, subtracting, we see that y := t~^{v') — C,~'^v' 
is fixed by each (Jq; hence y G k{w). Since yP — y = t~^{z') — C "-z' lies in 
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k[w] and has no term of degree a positive multiple ofp^, in fact y must lie 
in k. For (3 G k, we have 

r-\v' + /3) = C-"(^'' +f3)+ f3{l - C") + V, 

if 7^ 1, there is a unique choice of /3 for which v := v' +(3 satisfies t~^{v) = 
C,~'"'v. If = 1, then by replacing r by its p-t\i power (and choosing v' = v) 
we may assume that t~^{v) = v. At last, for z := — v £ k[w], we have 



ZT 



-\z) = T~\vP^ -V)= C-"K' -V) = C""Z, 



SO all terms of z have degree congruent to n mod r. This completes the 
proof. □ 



Corollary 3.9. Under the hypotheses of Proposition 3.7, suppose the inte- 
gers p,n,r satisfy 

(*) if n',i>0 and n' = p^n (mod r), then n' > n. 



Then conclusions (a)-(f) of Proposition hold if we require in addition 
that z = jw"' with 7 G /c* . 

Proof. Let v,w,z be as in the conclusion of the proposition, so z G k[w]. 
Then the degree of any nonconstant term of z is congruent to n mod r 
(by (f)) and has the shape n'p^ with < n' < n (by (c)) and < j < e 
(by (b)), so (*) implies n' = n. If p^ is the least power of p congruent to 1 
modulo r/ gcd(n, r), then (*) implies j = and we are done. If this condition 
does not hold then, by the hypothesis of the proposition, k = Ypn . In this 
case, write z = Yl^j=o OijW^^ , where each aj S F^e and some Uj 7^ (by 
(c)). Let V be an element of an extension of E satisfying v'^" —v = w^; then 
y := X]j=o Oij^^^ satisfies y^" — y = z, so y — y£ F^e. Since [k{v, w) : k{w)] = 
p'^ (by Lemma l3.3p and k{v,w) ^ k{v,w), we have k{v,w) = k{v,w), and 
the result follows. □ 

We now present values of the parameters for which (*) is satisfied. 

Lemma 3.10. The criterion (*) is satisfied if p^ > 4 and either of the 
following hold: 

(i) = 3 (mod 4), n \ {{p" + l)/4), r = {p" - l)/2. 

(ii) ^ 3 (mod 4), n \ p^ -\-\, n < p^ + 1, r = p'^ — 1. 

Proof. It suffices to prove (i) in case n = [p^ + 1)/4, since we can reduce the 
general case to this one by multiplying (*) by [p^ + l)/(4n). Now, 

n■p = n^ ^ — ^ — = nH ^ — (mod r), 

so 

n • = n H • (1 + p + • • • + = n H (mod r). 
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For < i < e we have 

p^ + l p' -1 p^ + l p73 - 1 - 3 

h < h — = — < r, 

4 2-4 2 12 ' 

so n + (p* — l)/2 is the least nonnegative residue of np* modulo r. In 

particular, the least such number is n; since p^ = 1 (mod r), this proves (i). 

Now consider (ii). We assume n > 1, since the result is clear for n = 1. 

Assume < i < e. Multiplying (*) by (p*^ + l)/n gives 

pe + 1 

• n' = p\p^ + 1) (mod r). 

n 

The right side is congruent to p^~^^, and it follows that its least nonnegative 
reside modulo r is itself (unless p = 2 and i = e — 1 in which case it is 1); 
but if n' < n then the left side is already reduced modulo r, so the only 
possibility is p odd, {p^ + l)/n = 2, and n' = p*. In that case n = 1 (mod r), 
contradiction. □ 

The specific values in this lemma are the ones we will use elsewhere in 
this paper. For completeness, we now present necessary and sufficient con- 
ditions for the fields k{v,w) (with v'^ — v = jw'^) to be determined by their 
ramification over k{w^). We first prove Lemma 11.41 which describes this 
ramification; this lemma has been known for many years. 

Proof of Lemma \1.4\ By Lemma [3.3| T'^ — T — 'jw^ is irreducible in k{'w)[T], 
so [k{v,w):k{'w)] = q and k{'w)rik{v,w) = k{w). It follows that A;(t', ^i;)//^;(^^;^) 
has degree qr; suppose this extension is Galois with group G. Since it is 
separable, r is coprime to q. Since it is normal, there must be elements of 
G which map w to any of its conjugates over k{w^); in particular, there 
exists a & G with a{w) = ^w, where C is a primitive r-th root of unity (and 
( £ k n k{v, w) = k). Write a{v) = Yli=o Vi'^^ with yi G k{w); then 

g-i 

= aivf - a{v) = Y^ivliv + ^w^Y - y,v'). 

i=0 

By considering the terms of degree i in v, for i = 1, q—2, . . . , successively, 
we find that = for i > 1, and also yo £ ¥q and = yi G Fg. This last 
statement may be restated as: r/ gcd(n, r) divides q — I. 

Conversely, assume that k contains a primitive r-th root of unity and 
r/ gcd(n,r) divides q — I. Let C be an r-th root of unity and let a G F^; 
then G ¥q. Then there is a A:-automorphism of k{v,w) mapping w 1-^ 
and V ^ C^v + a (since these equations define an automorphism of k{w)[X], 
and they preserve the ideal generated by X*^ — X — 71^"', so they define an 
automorphism of the quotient ring which is k{v, w)). These automorphisms 
form a group of order qr, and they all fix w'^ (where [k{v,w) : k(w'^)] = qr), 
so k{v,w) /k{w'^) is Galois. The ramification in this extension is as in (f), 
by Lemma 13.51 and Proposition 13.61 □ 

We conclude this section by proving Theorem 11.51 
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Proof of Theorem \1.5[ The first part of tlie tlieorem follows from Corol- 
lary [3i9] once we observe that the subfield E^^ has the form k{w); for this, 
note that E^^ /k{t) is cyclic of degree r with only two branch points (0 and 
infinity), both of which have degree one and are totally (and tamely) rami- 
fied, so E^^ is a genus zero function field over k having a degree one place, 
whence it indeed has the form k{w). 

Assume that (i) is violated, and let < n' < n satisfy nj?* = n' (mod r) 
for some i > 0; since np'^ = n (mod r), we may assume < i < e. Let v and 
w be transcendentals over k satisfying v'p" —v = w^^^ + w"^' . By Lemma [3.31 
[k{v, w) : k{w)] = p^. For any r-th root of unity C and any a G Fpe, there is 
a fc-automorphism of k{v, w) mapping w Cw and v v + a. These 

automorphisms form a group of order p^r, and their fixed field is k{w^), so 
k{v,w)/k{w^) is Galois. The ramification in this extension is as in (f), by 
Lemma 13.51 and Proposition 13.61 Now suppose that k{v,w) = k{v,w) where 
k{w'^) = k{w'^) and v'p — v = 'jw"' for some 7 G A;*. Then we would have 
w = f3w with f3 £ k* and v = X]f=o^ ViV^ with yi G k{w), so 

iPwr' + {f3wr' =vP'-v=Y, {yf{v + -fwy - y^e) , 

i=Q 

and we get a contradiction by considering successively the terms of degree i 
in -0 for i = — 1, p*^ — 2, . . . , 0. 

Now assume (ii) is violated. Pick an integer 1 < i < e such that = 1 
(mod r/ gcd(n, r)), and let v, w be transcendentals over k satisfying —v = 

+ Pw"'P\ where f3 G k\¥q. The above argument shows that k{v, w) /k{w^) 
is Galois with ramification as in (f), and that this extension cannot be 
written in the form k{v, w) /k{w^) for any v,w £ k{v, w) with v^" —v = ^w'^ 
and 7 G /c*. □ 



4. Producing polynomials 

In this section we use the results from the previous two sections to prove 
refined versions of the results stated in the introduction. We first describe 
the polynomials f{X) of degree p^{p^ — l)/2 (over a field k of characteristic 
p > 0) whose arithmetic monodromy group has a transitive normal sub- 
group isomorphic to PSL2(p'^), assuming that either the Galois closure of 
the extension k{x)/k[f{x)) does not have genus p^{p'^ — l)/2, or this exten- 
sion has no finite branch points. We then apply this result to produce all 
indecomposable polynomials / (over any field h) such that deg(/) is not a 
power of char k and either / is exceptional over k ox f decomposes over an 
extension of k. We begin with the following refinement of Theorem 11.61 

Theorem 4.1. Let k be a field of characteristic p > 0, let d = {q'^ — q)/2 
for some power q = p^ , and let f{X) G k[X] \ k[X'P] have degree d. Then 
the following are equivalent: 
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(1) Ga\{f{X) — u,k{u)) has a transitive normal subgroup isomorphic to 
PSL2(q'), and the extension k{x)/k{f{x)) either has no finite branch 
points, or has Galois closure of genus ^ [q^ — q)/'2. 

(2) There exist linear polynomials ii,i2 G k [X] such that the compo- 
sition ^1 o / o £2 is one of the following polynomials or one of the 
exceptions in Table B below: 



with q odd and m a divisor of {q + l)/2; or 



x-^lY^x 



{q+l)/m 



with q even and m a divisor of q + 1. 



In these cases, Gal(/(X) — u,k{u)) is either PSL2(g) (if m is even) or 
PGL2(g) (if rn is odd). Moreover, the Galois closure of k{x)/k{f{x)) is 
k{v,w) where v*^ — v = u;"*/gcd(m,2)_ 
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h = + 3)(X^'' - X'^^ + 1X^ -X* - 3f 

/3 = X^(X + 3f(X* - X^ + 2X^ - X - 3)^^ 
/4 = _ ^-^x^id + 6X-^ - - + ^^)'' 

/5 = (X - llf{X - 10f{X + sfiX^" - 5X^^ - lOX^^ + 7X" + X^'^ + bx'-'' - - lOX^'' - 8X^^ 

+ IIX" + 8X'' + lOX^ +X'' - &X'^ - SX^ + 6X* + 12X^ + 6X^ - X - 7)^^ 
fe = + 1)^(X^ - 9)'''(-3 - - BX" + IIX'^ + lOX** - lOX^^ - 2X" + TX^" - 6X^® + 5X^° 

- iX^"^ + SX^*^ + 2X^** + 2X^'' + 6X^^ + IIX^* - TX^*^ + 8X^** + x"")^ 

/7 = (X^ - 1)X*(X^ - 10f{-2 - X^ + IIX" - X^ +X^^ - 9X^^ - 5X^* + X^** + 2X^'' - eX^" + 2X^^ 

- ex^*** - 3X^^ + 6X*^ + 9X*^ + 4X*® - 3X^^ + 8X^* + IIX^'' + X=°)* 

/g = (X - 41)'' (X - 6)^°(X - 9)'^(19X + 46X^ + 21X^ + 2X* + 2X^ + lex" + SSX'' + 8X^ + 42X'' + 22X" 
+ 14X" + X" + 4X^^ + 12X^*' + 33X^^ + 41X^'' + 50X^'' + 27X^** + 37X^^ + 42X^'' + 8X^^ + 16X^^ 
+ 53X^^ + 28X^* + 9X^'^ + 56X^'' + 39X^'' + 42X^* + 13X^^ + 14X^'' + 28X^^ + 25X^^ + 26X^^ 
+ 43X^* + 34X^^ + lOX^^ + 17X'"' + 58X^* + 25X^® + 48X*° + 14X*^ + ISX"^ + 53X*^ + 39X" 
+ 58X''^ + 48X*® + 5X" + 8X** + 9X*® + 9X^° + 9X^^ + 27X^^ + 4X^^ + 13X^* + 56X^^ + x^**)™ 

fg = (X^ - 32)^X^^(X^ + 3)^(43 + 13X^ + 15X* + 2X'' + 57X** + 57X^'' + 15X^^ + 43X" + 35X^'' + 53X^* 
+ 35X^'' + 37X^^ + SIX^"* + SX^'' + 44X^** + 6X''° + 3X''^ + 28X-'''' + 44X-"' + 26X-'*** + 57X'"' 
+ 40X''^ + 41X" + IIX"**^ + 28X''^ + 57X'^" + 3X"^ + 56X''"' + eX^"^ + 30X''** + 16X''° + 26X''^ 
+ ISX"* + SeX^** + 19X''* + X™ + 7X" + SSX''* + X™ + X™ + 34X*° + 32X^^ + 16X** + 28X*'' 
+ 12X^« + 15X^" + 53X^" + 20X«* + 8X^^ + SX''* + 14X'°° + SSX^"^ + 54X^°* + 24X'°'' + 17X^°« 



+ 29X"''+X"=^)i" 



fig = (X^ - 35)^X^°(X^ - 3)^(27 + 45X^ + 30X'' + 26X^ + 41X^^ + 24X^^ + 16X^^ + 43X^^ + 7X^* 
+ 39X^'' + 24X^^ + X^" + 32X^^ + 47X''^ + 37X*^ + 38X''^ + 18X^^ + leX^" + 7X''° + 24X''^ 
+ 48X'"' + SX"^ + 54X^^ + 56X''^ + 36X™ + X^^ + 33X** + SSX^'' + 31X^° + 34X^^ + igX^" 

+ 17X^^ + 29X^''^ + 25X^''^ + leX^"** + 17X"^ + 2X"'' + 8X"^ + 46X^^'' + 53X"-^ + 54X^^'' 
+ 15X^^® + 24X"^ + 2X"^ + 49X^^** + 22X"^ + 36X"* + 36X"'' + SIX^'^'' + 15X^^^ + dX^^*^ 

+ 32x'^'' + ex^**^ + SSX'"^ + x^^®)'° 

/ii = X^(X^ +35)^(X^ + 32)^(54+ 12X^ + 49X^° + 33X^^ + 13X^'' + 31X^^ + 13X™ + 32X^^ + 6X'^° 
+ lOX"^ + 43X'^'' + IIX"" + 54X'"^ + 40X^'' + 49X^'^ + X**" + 13X**'^ + 37X^'' + 49X'"^ + 40X^'"' 
+ 10X^°^ + 43X"'' + 2X^^'' + 24X^^'^ + 54X"'' + 46X"^ + BX"" + 33X"^ + 35X^^'' + 23X^'^^ 
+ 2Xi«" + 57Xi«'5 + 15X1™ + 30X1^° + 32Xi^^ + 39X"° + SOX^^^^ + 50X^™ + 36X=°= + 55X^^° 
+ 15X^1^ + 30X^^° + 35X^^^ + 3X^™ + 53X^^^ + 37X^''° + 52X^*^ + 31X^^° + 6X^^^ + 35X 
+ 37X^^^ + 30X^''° + SIX^''^ + x^*°)^ 

Table B 



260 



The first four polynomials in Table B correspond to q = 11, the next 
three correspond to g = 23, and the final four correspond to g = 59. The 
geometric monodromy group G of each polynomial in Table B is PSL2(g), 
except for and /4 where G = PGL2{q). The point-stabilizer Gi of G is 
yl4 for the first two polynomials, S4 for the next five polynomials, and 
for the final four polynomials. The Galois closure of k{x) / k{fi{x)) has the 
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form k{v, w) with v'^ — v = w"^ and m = 1 (for i = 1, 3, 5, 8) or m = 2 (for 
i = 2, 6, 9) or m = 3 (for z = 4, 7, 10) or m = 5 (for i = 11). 

We postpone the proof of Theorem 14 . 1 1 until Section IT2l Here is an outline 
of the strategy. Let f{X) E k[X] satisfy the hypotheses of the theorem, and 
assume that (1) holds; then Theorem 12.11 lists the possibilities for the rami- 
fication in E/k{f{x)), where E denotes the Galois closure of k{x)/k{f{x)). 
For each ramification possibility, let G and Gi be the corresponding possi- 
bilities for the geometric monodromy group and a one-point stabilizer. Let 
/ be the inertia group of a place of E lying over the infinite place of k(f{x)). 
First we show that E^ has genus zero, and that the ramification in E/E^ is 
described by (f) (cf. Lemma [1.4p . Then Theorem 1 1 . 5 1 and Lemma [3 . 1 1 imply 
that E = k{v,w) where v^" — v = w^. The automorphism group Aut^(i?) 
was determined by Stichtenoth [38]; in our cases, it has a unique conjugacy 
class of subgroups isomorphic to G. We compute the subfield k{u) of E in- 
variant under one such subgroup, and also the subfield k(x) invariant under 
the one-point stabilizer Gi. Finally, we compute the rational function / for 
which u = f{x); for suitably chosen u and x, the rational function / will in 
fact be a polynomial / satisfying (1). Moreover, this construction produces 
all polynomials satisfying (1). 

4.1. Consequences of Theorem 4.1. We now use Theorem 14. II to deduce 
the remaining results mentioned in the introduction. First consider Theo- 
rem [L2l Our next results classify the examples in case (iii) of Theorem [L2l 
assuming that item (1) of Theorem 14.11 holds . (We will remove this assump- 
tion in [19}, which leads to a new family of examples in characteristic 2.) We 
classify these polynomials up to equivalence, where we say that b,c £ k[X] 
are equivalent if 6 = £i 000^2 for some linear polynomials ^1, ^2 G k[X]; triv- 
ially, this equivalence relation preserves indecomposability, exceptionality, 
and both the arithmetic and geometric monodromy groups. 

Theorem 4.2. Let k be a field of characteristic 3, and let q = 3^ with e > 1 
odd. The following are equivalent: 

(i) there exists an indecomposable exceptional polynomial f G k[X] of 
degree q{q — l)/2 for which PSL2(q') is a transitive normal subgroup 
ofGal{f{X)-u,k{u)); 

(ii) A; n = F3 and k contains non-square elements. 

Moreover, for any f as in (i), the Galois closure of k[x) / k[f [x)) is k{v,w) 
where — v = u;" and n divides {q + l)/4; here n is uniquely determined 
by f , and we associate f with n. Conversely, suppose (ii) holds, and fix a 
divisor n of {q + l)/4. Then there is a bijection between 

• the set of equivalence classes of polynomials f which satisfy (i) and 
are associated with n; and 

• the set of even-order elements in /c*/(A;*)^". 

One such bijection is defined as follows: for a £ k* , if the coset a{k*)'^^ G 
k* /{k*)"^^ has even order, then this coset corresponds to the equivalence class 
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of the polynomial 

(g+l)/(2n) 

X2n 



/ / Tu-2n ^\{q-l)/2 , ^(g-l)/2 



- a) 



In particular, suppose that k is finite and A; n Fg = F3. Then, for each 
divisor n of (g + l)/4, there is a unique equivalence class of polynomials 
/ which satisfy (i) and which are associated with n. For A; = F3, or more 
generally if A; ^ Fg, the examples that arise are precisely the polynomials 
described in [28]. If A; 5 Fg then the polynomials in the theorem are new 
examples of indecomposable exceptional polynomials. Finally, let r be the 
largest power of 2 dividing [A; : F3]; then, for any fixed divisor n of {q + l)/4, 
the equivalence class of polynomials associated with n and satisfying (i) 
contains a polynomial defined over F3r but does not contain any polynomials 
defined over proper subfields of F3r. 

There exist infinite fields k (for instance, k = F3(y) with y transcendental) 
for which there are infinitely many equivalence classes of polynomials over k 
satisfying (i). It is interesting to note, however, that for any k (finite or 
infinite), any polynomial over k which satisfies (i) is equivalent over k to 
one of the polynomials over F3 exhibited in [28], even though the latter 
polynomial might not be exceptional over k. We will see below that a 
similar remark applies in the case of characteristic 2. 

We now prove Theorem 14.21 We first show that exceptionality cannot 
hold if G := Gal(/(X) — n, k{u)) = PGL2(g): assume the opposite. Arguing 
as in the proof of Lemma 12.21 we can identify A := Gal(/(X) — u,k{u)) 
with a subgroup of FTh2{q), so A/G is cyclic. Exceptionality of / implies: 
for any fi G A, ii fiG generates A/G then fj, has exactly one fixed point 
(cf. [21 Lemma 6] or 123\ Lemma 4.3]). Since q = 3 (mod 4), we can view 
the permutation actions of G and A as actions on the involutions in L := 
PSL2(^) (as in the proof of Lemma 12. 4p . For any n € A such that fiG 
generates A/G, note that fiG = aG for some field automorphism a, and a 
centralizes PSL2(3) and so fixes at least three involutions of L, contradicting 
exceptionality. 

In light of Theorem 12.11 it follows that any indecomposable exceptional 
polynomial as in Theorem 14.21 must be equivalent over k to one of the poly- 
nomials in Theorem 14.11 with m even. There are several ways to proceed; 
the quickest, given what has already been done, is to compute the fields of 
definition for the irreducible factors of f{X) — f{Y) in k[X, Y], for each poly- 
nomial / over k which is equivalent to one of the polynomials in Theorem l4.1l 
with m = 2n. This bivariate factorization was derived in [32]. This gives 
the statement of Theorem 14.21 The result (and its proof) for characteristic 
two is similar. 



Theorem 4.3. Let k be a field of characteristic 2, and let q = 2^^ with e > 1 
odd. The following are equivalent: 
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(i) there exists an indecomposable exceptional polynomial f G k[X] of 
degree q{q — l)/2 for which PGL2{q) is a transitive normal subgroup 
o/Gal(/(X) — u,k{u)), and the extension k{x)/k{f{x)) either has 
no finite branch points or has Galois closure of genus ^ {q^ — q)/2; 

(ii) kr^¥q = ¥2. 

Moreover, for any f as in (i), the Galois closure of k{x) / k{f [x)) is k{v,w) 
where v'^ — v = w"^ and n divides q + 1; here n is uniquely determined by f , 
and we associate f with n. Gonversely, suppose (ii) holds, and fix a divisor 
n of q + 1. Then there is a bisection betweei^ 

• the set of equivalence classes of polynomials f which satisfy (i) and 
are associated with n; and 

• k*/{k*Y. 

One such bijection is defined as follows: for a £ k* , the coset a{k*)"' S 
corresponds to the equivalence class of the polynomial 

^1=0 

Consider the case of finite k, and assume kn¥q = F2. Then each divisor 
n of g + 1 corresponds to a unique /c-equivalence class of polynomials as in 

(i) , except when /c 5 F4 and 3 | n, in which case there are three classes. For 
k = F2, or more generally if either /c ^ F4 or 3 f n, this implies that the 
only polynomials satisfying (i) are the ones described in ^132j. However, if 
A; 3 F4 and 3 | n then we get new examples of indecomposable exceptional 
polynomials. 

Finally, consider Theorem ll.il The proofs in [21^ I22j show that, in cases 

(ii) and (iii), the arithmetic monodromy group A := Gal(/(X) — u,k{u)) 
is either PSL2(p) or PGL2(p), with p £ {7,11}. Indecomposability of / 
implies that ^ is a primitive permutation group of degree (p^ —p)/2. Since 
/ decomposes over some extension of k, it decomposes over k, so the geo- 
metric monodromy group G := Gal(/(X) — u, k[u)) is a normal imprimitive 
subgroup of A. Thus we must have A = PGL2(p) and G = PSL2(p). Now 
Theorems 12.11 and 14 . 1 1 determine / up to equivalence over k, and a straight- 
forward computation with coefficients determines which members of these 
equivalence classes are indecomposable over k. The result is as follows: 



^This statement must be modified in case n = q + 1 and k is not perfect. In tfiis case, 
we will define a bijection between tlie set of fc-equivalence classes of polynomials / as in (i) 
which are associated with g + 1, and the set of equivalence classes of pairs {a, P) £ k* x k 
modulo the relation: (a,/3) ~ (q',/3') if there exists 7 G A; such that 7''''''^ — a' /a and 
VP + l\fW G fc- Specifically, we let the class of (a, /3) correspond to the fc- equivalence 
class of the polynomial 

/3 + 2a2'-i(X + /3)«(2'-i)+2\ 

i=0 
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Theorem 4.4. Let k be a field of characteristic p > 0. The following are 
equivalent: 

(i) There exists an indecomposable polynomial f G k[X] such that f 
decomposes over some extension of k and deg(/) is not a power of 



(ii) k contains nonsquares and p E {7,11}. 

Moreover, for any f as in (i), the Galois closure of k{x) / k{f [x)) is k{v,w) 
where — v = w'^ and n \ 2; here n is uniquely determined by f , and we 
associate f with n. Conversely, suppose (ii) holds, and fix a divisor n of 2. 
Then there is a bijection between 

• the set of equivalence classes of polynomials f which satisfy (i) and 
are associated with n; and 

• the set of nonsquares in k*/{k*)'^"'. 

One such bijection is defined as follows: for any nonsquare a £ k* , the coset 
a(A;*)^" G A;*/(/c*)^" corresponds to the k-equivalence class of 



where h{X) = - aX^ + 2a^X'^ - a^X - 3al 

4.2. Proof of Theorem 14.11 Let f{X) G k[X] satisfy the hypotheses of 
Theorem 14. H let q = p^, and assume that item (1) of the theorem holds. 
Then Theorem 12 . 1 1 applies . Since the conclusion of Theorem l2.1l is unchanged 
when we replace k by k, and likewise this replacement does not affect (2) of 
Theorem 14. H we assume henceforth that 



Let E denote the Galois closure of k{x)/k{f{x)), let G = Gal{E/k{f{x)), 
and let Gi = Gal{E/k{x)). Let / be the inertia group of a place P oi E 
lying over the infinite place of k{f{x)), and let V be the Sylow p-subgroup 
of /. Assume that the triple q, G, Gi is not listed in Table A (we will 
return to the cases in Table A at the end of the proof). Then / satisfies 
(i)-(iv) of Theorem 12. 1[ In particular, G is either PGL2(g) or L, and / is 
a Borel subgroup of G, and the higher ramification groups for P satisfy 
V = Ii = ■ ■ ■ = In ^ Gn+i = 1. Also we have q > 3. We first show that 
E = k{v, w) where v'^ — v = w"^. 

Lemma 4.5. There exists t £ E such that E^ = k{t) and the ramification 
in E/E^ is as in (f) of Lemma [iT^l with r = q — I if G = PGL2(g) and 
r = {q — \) /2 otherwise. 

Proof. First we show that / has trivial intersection with the inertia group J 
of any place of E lying over a finite place of k{f{x)). By (iv) of Theorem l2.H 
any such J is cyclic of order dividing g + 1; since gcd(g + 1, |/|) < 2, if 
J n / 7^ 1 then J D I has order 2. Ii q = 3 (mod 4) then 2 | |I| implies that 




k is algebraically closed. 
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G = PGL2(g), and all involutions in I lie in G \ L; but the order of J is 
divisible by 4, so its involution lies in L, whence JCiI = 1. If g = 1 (mod 4), 
then the involution of J lies in G \ L but the involutions of I lie in L. If 
q = (mod 2), then J contains no involution. Thus, in all cases J D I = 1, 
so E/E^ is unramified over places of E^ lying over finite places of k{f{x)). 

Next we consider the inertia groups of places of E lying over the infinite 
place of k{f{x)); these are precisely the conjugates of / in G (i.e. the Borel 
subgroups of G), and, since / is self- normalizing in G, no two of these places 
have the same inertia group. The intersection of any two distinct Borel 
subgroups of G has order r (by Lemma IA.4P , so each of the q places of E 
which differ from P and lie over the infinite place of k{f{x)) have ramification 
index r in E/E^ . Hence all ramification in E/E^ occurs over two places of 
E^ ^ one of which is totally ramified and the other of which has ramification 
index r. We now compute the genus of E^ : 

{q-l){n-l)-2 = 2gE-2= (2gj^i - 2)qr + {qr - 1) + n{q - 1) + q{r - 1), 

so = 0. Since k is algebraically closed, it follows that E^ = k{t) for some 
t. Finally, we can replace t by some {at + 13)/ {'yt + 6) (with a, (5,^,5 e k) 
to make the infinite place of k{t) be totally ramified in E, and to make be 
the only finite place of k{t) which ramifies in E/k{t). □ 

For n 7^ g + 1, we will apply Theorem 11.51 to the extension E/E^; first 
we must verify (i) and (ii) of that result. Condition (ii) is trivial, since 
r/gcd(n,r) > (g — l)/2 > ^ — 1. For the specific values of n and r under 
consideration, condition (i) is proved in Lemma 13.101 Hence Theorem 11.51 
applies to the extension E/E^ , so E = k{v,w) where v'^ — v = w^. 

Now assume n = q + 1, so p = 2 and gE = {q^ — q)/2. The previous 
lemma shows that EjE^ is only ramified over one place, where it is totally 
ramified with the only jump in the ramification occurring after the n-th 
ramification group; this implies that E^ has genus zero, so E^ = k{w). 
Then Proposition 13.71 applies to the tower E 5 k{w) 5 E^ , so we conclude 
that E = k{v, w) where v"^ — v £ k[w]; the degree n' of any term of v'^ — v (as 
a polynomial in w) satisfies n' = q + 1 (mod q — 1) and q f n' , and moreover 
g + 1 is the largest integer coprime to p which divides some such n' . We can 
write n' = r2* where r is odd, 1 < r < g + 1, and < i < e. Then we have 
r = 2^+^"* (mod 2*^ — 1), and the only possibilities are r = 2^ + 1 (and i = 0) 
or r = 1 (and i = 1). Thus, v'^ — v = aw'^ + Pw'^'^^, where a £ k and jd £ k* 
(and, by replacing w by fi^^^'^^'^'^w, we may assume (3 = 1). If a 7^ then, 
by }38l Satz 7], every A;-automorphism of E preserves the place P] hence 
Autfc(-E) is the decomposition group of P in the extension E / E^^^^^^\ so 
it is solvable, and thus has no subgroup isomorphic to L, a contradiction. 
Thus E = k{v, w) where v'^ — v = w'^^^. 

Our next task is to determine all subgroups of ^ := Autk{E) isomorphic 
to G. Recall that n divides q + 1. We exhibit three subgroups of Q. There 
is an elementary abelian subgroup U of order q, whose elements fix w and 
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map V I— > ti + a with a £¥q. There is a cyclic subgroup H of order n(q—l), 
whose elements map v and w (^w where = 1. And there is 

a cyclic subgroup J of order 2 or 4, generated by the automorphism sending 
V I— > 1/v and w i— > {—l)^^^w/v^'^~^^^^"' , for any choice of n-th root of —1; this 
group has order 2 precisely when (—1)^/" = —1. One can verify that these 
maps are automorphisms by observing that they are bijections of 
which induce bijections on the ideal generated hy v'^ — v — X", so they 
are bijective on the quotient E. Let Gq be the group generated by U, H, 
and J. Note that each element oi U U H U J induces an automorphism of 
k{v); the induced automorphisms are v ^ v + a (for a £ ¥q), v (for 
C, G F*), and v ^ 1/v. These automorphisms generate the group PGL2(g). 
Hence, restriction to k(v) induces a homomorphism p: Qq — > AvXk{k{v)) 
whose image is PGL2(g); the kernel of p is the cyclic subgroup Z of of 
order n (since Z = Gsi\{E / k{v))) so \Qq\ = n[q^ — q). Also, Z commutes 
with all elements of U , H, and J, so Z lies in the center of Gq. 

Now we compute the subfield E^°; this field equals k{v)^'^^^^'^\ The latter 
field was computed by Dickson [U p. 4]: it is k{{v'^ — yY^^ /{v'^ — vY 
(to verify this, note that this rational function is fixed by each element of 
PGL2(g), and its degree \s — q = \ PGL2((?)|). Since v'^ — v = w^, we can 
rewrite this generator in terms of w. E^° = k{w"'^'^~'^ )(it;"('?-i) -|- 
Put u := u;«-9'(w;"(9-i) + i)(<?+i)/"; then we have E^o = fc(u"), so G := 
Gal{E/k{u)) is a subgroup of Qq of order q^ — q. 

Suppose p is odd. Put U := -^;(9-9')/2(a;n(g-l) ^ ^)(g+l)/(2n,) ^ I ._ 

Gal{E/k(u)) is a subgroup of G of index two. Then u is not fixed by any 
nontrivial element of Z, so p induces an isomorphism between L and the 
unique subgroup of PGL2((j') of index two (namely PSL2(g')). Moreover, L 
is a normal subgroup of Go with cyclic quotient of order 2n. 

Now suppose n is odd (but we no longer restrict p). Then ii is not fixed 
by any nontrivial element of Z, so p induces an isomorphism G = PGL2(9); 
thus Qo = G X Z = PGL2((?) x C„. Note that all elements of G x Z of 
order p are in G; thus, any subgroup of Gq isomorphic to PSL2(g) contains 
all such elements, and so must be the unique subgroup of G isomorphic to 
PSL2((?) (since this subgroup is generated by the elements of order p). If 
p = 2 then this subgroup is G. If p > 2 then this subgroup is L. Moreover, 
ifl<n<g + l and p > 2, then Go/L is cyclic of order 2n, so G is the only 
subgroup of Gq isomorphic to PGL2(g). 

Next assume that n is even. Then n divides {q + l)/gcd(4, g + 1), so 
g = 7 (mod 8). In particular, q is odd, so 1 < n < g + 1. From above we 
know that Go has a unique subgroup isomorphic to PSL2(g). We now show 
that Go has no subgroup isomorphic to PGL2(g). We know that Go has a 
normal subgroup L with cyclic quotient of order 2n. If Go has a subgroup 
G isomorphic to PGL2((j'), then (since PGL2(g) has trivial center) we would 
have Go = G X Z , so Go / L = G2 X Gm ^ G2m, a contradiction. 
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If I < n < q + I, then Stichtenoth proved that \Q\ = n{q^ — q) \28\, so 
G = Go; hence G has a unique subgroup isomorphic to PSL2(g), and has a 
subgroup isomorphic to PGL2{q) if and only if n is odd, in which case it 
has a unique such subgroup. If n = 1 then E = k{v), so G = PGL2(A:); this 
group has a unique conjugacy class of subgroups isomorphic to PSL2(g'), and 
a unique conjugacy class of subgroups isomorphic to PGL2(g'). Finally, if 
n = q + 1 (so p = 2) then Leopoldt showed that G = PGU3(g^) [29], and this 
group has a unique conjugacy class of subgroups isomorphic to PGL2(g'). 
Since conjugate groups will lead to the same polynomials, we may assume 
in every case that 

E'^ is either k(u) or k{u). 

We now compute the subfield of E invariant under the one-point stabilizer 
Gi of G. Since G has a unique conjugacy class of subgroups isomorphic to 
Gi, and conjugate groups Gi will lead to the same polynomials, it suffices 
to do this for a single point-stabilizer Gi. 

To complete the proof, we must compute the polynomials / in each of 
three cases: q is odd and G = G = PGL2((?); q = 3 (mod 4) and G = L = 
PSL2((?); q even and G = G = PGL2(g). The computations in each case are 
similar, so we only give the details for the first case. Thus, for the remainder 
of the proof we assume that 

q is odd and G = G ^ PGL2(g), 

so also 

n is odd and Gi is dihedral of order 2{q + \). 

To exhibit such a group Gi, view GL2((7) as the invertible Fg-linear maps 
on a two-dimensional Fg-vector space, and choose this vector space to be 
Fg2. Then the multiplication maps by the various elements of F*2 form a 
cyclic subgroup of Gh2{<l)] the group generated by this cyclic group and the 
q-ih power map has order 2{q^ — 1), and its image in PGL2((7) is dihedral of 
order 2{q + 1). We make this explicit by choosing a nonsquare 70 G F* and 
letting 5 G F*2 be a square root of 79. Choose the basis {1,5} for Fg2/Fq; 
with respect to this basis, the matrix for the multiplication map hy a + [55 
(where a,/? G F^ are not both zero) is (^^2°)' matrix for the q- 

th power map is ( J _?i ) • These matrices generate a dihedral subgroup of 
PGL2(g) of order 2{q + 1); let Gi be the intersection of G with the preimage 
under p of this dihedral group. 

Our next task is to compute the subfield of k{v) fixed by Gi; this will 
coincide with E^^^^ . Let 7 = I/70. Certainly Gi fixes the sum of the 
images of under Gi, namely 
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Here the factor — 1) comes from the fact that the pairs {a, (3) and 
{aC, PC) (with C G F*) correspond to the same element of Gi. Thus each 
term of Gi corresponds to a unique pair (a, (3) E with either /3 = 7 or 
both (3 = and a = 1, so 

note that x = h{v)/{v'^ — v)'^ for some monic b{X) £ Fg[X] of degree 2q + 2. 
Here b{X) has no term of degree 2q + 1. For any a £ ¥q, multiply ([1]) by 
(f + a)^ and then substitute v = —a to find (— + 7)^ = 6(— a); hence 
b{X) = (X2-7)2 + (X'?-X)c(X) where c(X) G Fg[X] is a monic polynomial 
of degree q + 2 having no term of degree q + 1. We compute the derivative: 
b'{X) = 4X(X2 - 7) - c{X) + (X<? - X)c'{X). For any a G F,, multiply ^ 
by (u + a)^, take the derivative of both sides, and then substitute v = —a; 
this gives 2a(— + 7) = b'{—a), so c{v) = 2v{v'^ — 7) + {v'^ — v)a{v) where 
a{X) = X'^ + £^ and ^ € Fg. The choice of ^ is irrelevant, since changing ^ 
amounts to adding a constant to x; but regardless, it is easy to show that 
^ = (e.g. by computing appropriate terms of {v'^ — v)'^x). Hence 

b{v) = {{v^ - 7) + v{v'' -v)f = {v''+^ - 7)^ , 

so X = {v'^^^ — 7)^/ [v'^ — v)"^. Since [k{v) : k{x)] = deg(x) = 2{q + 1) equals 
and Gi fixes x, it follows that E'-'^^^ = k{v)^^ = k{x). 
We have shown that k{v)'^ = k{vP') and k{v)'^^ = k{x), where = 
(v"? — v)'^^^/{v'^ — vY hence = h{x) for some h{X) G k{X) which 
we now determine. Write h{X) = 5,Y\i{X — Oi)''', where the Ui are distinct 
elements of k, the are nonnegative integers, and £ k* . Then we have 

Let hi{X) = [X'^'^^ — 7)^ — ai{X'^ — X)'^; since 7 is a nonsquare in F*, no 
two hi have a common root, and also no hi has a root in Fg. Since the poles 
of the left side of ([2]) are precisely the elements of F^, we conclude that each 
ri is positive (so /i is a polynomial) and X^^i = il'^ ~ Equating the 

leading coefficients of the two sides of ([2]) gives ^ = 1. The roots y = uj 
of the left side of ([2]) are precisely the values lv G Fg2 \ Fg, and each has 
multiplicity (? + 1; any such a; is a root of hi{X) where 

_ (0;"+^ - 7)^ 
(u;5-c^)2 ' 

so aJ^+^^Z^ = -ai. Since 2/ii(X) + {X'i-Xfh[{X) = 2{X'i+^ -^){X'^-^Y, 
any multiple root rj of /ij must satisfy either 7/*^+^ = 7 or r/^ = 7; in the former 
case, = and hi = {X'^^^ — 7) 2, so is a root of multiplicity two; in the 
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latter case, = 7 and hi = {X'^ — 7)'^"^, so 77 is a root of multiplicity q + 1. 
Hence h{X) £ k[X] divides 

9+1 

x(«+i)/2(X-7) 



X-7 / 

since both these polynomials are monic of degree (g^ — q)/2, they must be 
the same. 

We now determine all possibilities for the original polynomial /. We 
have shown that h{x) = -u", where E^^^^ = k{x) and E'-' = k{u); we will 
modify this polynomial identity to express -u as a polynomial in some x with 
E^^ = k{x). We know that x will be the n-th root of some generator of 
k{x)] from above, 

so we choose x = {v"^ — j)^''^^^^^ /w"^ . Then h{X) := h{X + 7) satisfies 
/i(x") = n"; taking n-th roots gives 



(n= (x" + 7)('?+i)/{2")£ 



for some n-th root of unity C. We may assume C = 1 (by replacing u by ^u). 
Thus u = f{x) where f{X) G k[X] is defined by 

fix) := XiX- + 7)(^+^)/- 

Hence Gal{E/k{x)) is an index-n subgroup of Gi xZ which is also a subgroup 
of G, so it is Gi. Since Gi contains no nontrivial normal subgroups of G, 
the Galois closure of k{x)/k{u) is E^ so the monodromy group of / is G. 
The only choices we made which restricted the possibilities for the original 
polynomial / were the choices of generators x and u for the fields E'^^ and 
E^; hence, the polynomials / in this case are precisely the polynomials 

o / o £2, where ii and £2 are linear polynomials in k[X]. This completes 
the proof of the theorem in case q is odd and G = PGL2(g). As noted 
above, the completion of the proof in the other two cases is similar. In the 
statement of the result there is only a single family of polynomials covering 
both cases with q odd; this occurs because, when q is odd and G = PSL2(g'), 
the resulting polynomials can be obtained by substituting 2n for n in the 
above expression for /. 

Finally, we consider the group-theoretic possibilities in Table A, which 
lead to the polynomials in Table B. The cases with q odd can be treated 
in a similar manner to what we have done above; in particular, in each 
case a fixed point computation similar to that of Lemma 12.41 can be used 
to determine a short list of possibilities for the ramification (as in the proof 
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of Theorem I2.ip , after which Theorem 11.51 imphes that the Galois closure 
of k{x)/k{f{x)) is k{v,w) where v'' — v = w^, and we conclude the proof 
precisely as above. Table A also includes the possibility that q = 4, m which 
case G = PTL2{q) — S5. A Riemann-Hurwitz computation shows that / 
must be cyclic of order 6, and that the Galois closure E of k{x)/k{f{x)) 
has genus one. However, the automorphism groups of function fields of 
genus one are known: in our case, Autfc(i?) is the semidirect product H ><i J, 
where H is the (abelian) group of translations by points on the elliptic 
curve corresponding to E, and J has order either 2 or 24. If Autfc(-E') has 
a subgroup G isomorphic to 5*5, then G H H is a normal subgroup of G 
of index less than 24, so G D H ^ A^; in particular, H contains a Sylow 
2-subgroup of A^, namely a Klein 4-group, contradicting standard results 
about the structure of the group of points on an elliptic curve \37\ Cor. 6.4]. 
Thus there are no polynomials corresponding to the case q = 4 in Table A. 
This concludes the proof of Theorem 14.11 

Appendix. Group theoretic preliminaries 

In this appendix we summarize the basic group theoretic facts used in this 
paper. Let ¥g be a field of order q and characteristic p. As usual, GL2((?) 
denotes the group of invertible two- by- two matrices over F^, and SL2(g) is 
its subgroup of determinant-one matrices. The centers of these groups are 
the scalar matrices, which in the case of GL2(g) are just F* and in the case 
of SL2(g) are {±1}; the quotients of GL2(g) and SL2(g) by their centers are 
denoted PGL2((?) and PSL2(g), respectively. We often write L for PSL2(g). 
The orders of these groups are as follows: |GL2(g)| = (g^ — 1)(9^ — q), 
|PGL2(g)| = |SL2(g)| = q^-q, and |PSL2(g)| = (q^ - q)/o, where o = 
gcd(2,g-l). 

We now discuss the structure of L = PSL2(g). The most important 
property of L is that, for g > 4, it is a simple group [40, §1.9]. For small 
q, we have the isomorphisms PSL2(2) ^ 53, PSL2(3) ^ A^, and PSL2(4) ^ 
PSL2(5) = A^. For general q, the subgroups of PSL2(g) were determined by 
Dickson in 1901 [TJ §260]; a treatment in modern language is [401 §3.6]. We 
state the result for the reader's convenience. As above, o = gcd(2,g — 1). 

Theorem A.l (Dickson, 1901). The subgroups o/PSL2(g) are precisely the 
following groups. 

(i) The dihedral groups of order 2{q it l)/o and their subgroups. 

(ii) The group B of upper triangular matrices in PSL2(g), and sub- 
groups of B (here, the order of B is q{q — l) / o, the Sylow p- subgroup 
U of B is elementary abelian and normal in B, and the quotient 
group B/U is cyclic). 

(iii) A4, except if q = 2^ with e odd. 

(iv) 5*4, ifq = ±l (mod 8). 

(v) A^, except if q = ±2 (mod 5). 

(vi) PSL2(r), where r is a power of p such that r"^ = q. 
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(vii) PGL2(r), where r is a power of p such that r^*" = q. 

This result describes the isomorphism classes of subgroups of L = PSL2((j'); 
we are also interested in conjugacy classes of subgroups. We only need this 
in certain cases. 

Lemma A. 2. For q > 3, there are {q^ — q)/2 subgroups of L which are 
dihedral of order 2{q + l)/o, and any two of these are conjugate. Let J be 
a nontrivial cyclic subgroup of L whose order divides {q + l)/o; then the 
normalizer of J in L is dihedral of order 2{q + l)/o. 

Proof. By Theorem lA.ll L has a dihedral subgroup H of order 2{q + l)/o, 
and this subgroup is maximal unless q = 7 (when 5*4 is a possible over group) 
or q = 9 (when is a possible overgroup). Since L is simple, it follows 
that H is the normalizer (in L) of any of its cyclic subgroups of order more 
than two, and also that H is self-normalizing in L. Let H' be another 
dihedral subgroup of L of order 2{q + l)/o, and suppose \J\ > 2. Let s be 
an odd prime divisor of g + 1 if any such exists, and otherwise put s = 2; 
then Sylow s-subgroups of H and H' are also Sylow subgroups of L, and 
so are conjugate, whence their normalizers H and H' are conjugate as well. 
Likewise, a Sylow s-subgroup of J is conjugate to a cyclic subgroup of H, so 
its normalizer is conjugate to H; since J is contained in the normalizer, J is 
conjugate to a subgroup of H, so its normalizer is conjugate to H. We have 
shown that there is a unique conjugacy class of dihedral subgroups of L of 
order 2(g + l)/o, so the size of this class is |L : Nl{H)\ = \L: H\ = [q^ — q)/2. 
This concludes the proof in case \J\ > 2; the case | J| = 2 is included in the 
next lemma. □ 

By an involution of a group, we mean an element of order two. 

Lemma A. 3. L contains a unique conjugacy class of involutions. For q 
odd, PGL2(g) contains two conjugacy classes of involutions. The number of 
involutions in PGL2((7) is either q^ (if q odd) or — 1 (if q even). For q 
odd, the number of involutions in L is either {q'^ — q)/2 (if q = 3 (mod 4) ) 
or {q^ + q)/2 (ifq = l (mod 4) For q even, the centralizer of an involution 
of PGL2(g) is a Sylow 2-subgroup. For q odd, the centralizer in FGL2{q) 
of an involution of PGL2((7) is dihedral of order either 2{q + 1) or 2{q — 1), 
and the centralizer in L of this involution is dihedral of half the size; order 
2[q + 1) occurs when q = 3 (mod 4) and the involution is in L, and also 
when q=l (mod 4) and the involution is not in L, and order 2{q—l) occurs 
otherwise. 

Proof. One immediately verifies that a nonidentity element ( " (5 ) of PGL2 {q) 
is an involution if and only ii 6 = —a; it is then a triviality to count the in- 
volutions in either PGL2(g) or L. For q even, let U be the group of matrices 
(q which is a Sylow 2-subgroup of L; then U is elementary abelian and 
is the centralizer (in PGL2((7)) of any nontrivial ^ £ U. Since any involution 
in L is conjugate to an involution in U, the centralizer of an involution is a 
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Sylow 2-subgroup. But the number of involutions of L which are conjugate 
to a fixed involution /j, e U is \L : Nl{{ij))\ = \L : U\ = — 1, so L contains 
a unique conjugacy class of involutions. Henceforth assume q odd. First 
consider the involution ( ^ which lies in L if and only if g = 1 (mod 4) : 
its centralizer in PGL2((7) (respectively, L) consists of all the diagonal and 
antidiagonal elements, and so is dihedral of order 2(q — 1) (respectively, 
q — 1). Hence the number of conjugates of this involution by either L or 
PGL2(g) is \L\/{q - 1) = {q^ + q)/2. We will show that PGL2(g) contains a 
dihedral subgroup H of order 2(g + 1); we now show how the remainder of 
the lemma follows from this statement. Since L has no cyclic subgroup of 
order q + 1, the intersection HCiL is dihedral of order q + 1. The center of H 
is generated by an involution v, and f lies in L if and only if 4 | (q + l). The 
centralizer of in L contains H D L; this centralizer is a proper subgroup 
of L (since no nonidentity element of PGh2{q) centralizes L), so it must be 
HnL (since H CiL is maximal unless g = 7 or 9, and in those cases we note 
that S4 and ^5 have trivial center). Then the centralizer of u in PGL2(q') 
must be H (since it contains H and has H f] L as a subgroup of index at 
most two). Finally, the number of conjugates of v by either L or PGL2(5) 
is |L : n L| = I PGL2(g) : H\ = {q^ — q)/2, which completes the proof. 

Now we must show that PGh2{q) contains a dihedral subgroup of order 
2{q + 1). For this, we view GL2{q) as the invertible Fg-linear maps on a 
two-dimensional Fg-vector space, and we choose this vector space to be ¥^2. 
Then the multiplication maps by the various elements of F*2 form a cyclic 
subgroup of GL2((7); the group generated by this cyclic group and the q-th 
power map has order 2(g^ — 1), and its image in PGL2(^) is dihedral of order 
2(g + l). □ 

Let G denote either PGL2(g) or PSL2((?); then a Borel subgroup of G is 
any subgroup conjugate to the group of upper-triangular matrices in G. 

Lemma A. 4. Let G be either PGL2(g) or PSL2(g). A Borel subgroup of 
G is self-normalizing. The intersection of any two distinct Borel subgroups 
of G is cyclic of order either q — 1 (if G = PGL2(g)j or {q — l)/2 (if 
G / PGUiq)). 

Proof. One easily verifies that the upper-triangular matrices B are self- 
normalizing, so the same is true of any Borel subgroup of G. Hence there 
are |G : -B| = q + 1 Borel subgroups of G. One of these is the lower-triangular 
matrices, which intersects B in the diagonal. The number of conjugates of 
the lower-triangular matrices under B is then the index of the diagonal in 
B, namely q, so the conjugation action of G on its Borel subgroups is doubly 
transitive, and thus the intersection of any two distinct Borel subgroups is 
a conjugate of the diagonal. □ 

Next we consider the automorphisms of PSL2(g). Since PSL2((7) is a 
normal subgroup of PGL2(g), these include conjugation by any element of 
PGL2(g); since no nonidentity element of PGL2(g) centralizes PSL2(q'), this 



POLYNOMIALS WITH PSL(2) MONODROMY 



43 



gives an embedding of PGL2(g) into the automorphism group Aut(PSL2(9)). 
Any a S Gal(Fg/Fp) induces an automorphism of PSL2(g) by acting on the 
matrix entries; these automorphisms are cahed field automorphisms. The 
group Gal(Fq/Fp) normahzes PGL2((?); let PrL2(g') denote the semidirect 
product of PGL2(^) by Gal(Fg/Fp). Then PTL2iq) = Aut(PSL2(9)) [21 
Thm. 12.5.1]. 

We need one result about subgroups of PrL2(g'). 

Lemma A. 5. Let G be a subgroup of FTL2{q) containing L, where q > 3. 
There are precisely {q^ — q)/2 subgroups Gi of G such that \G : Gi\ = {q^ — 
q)/2 and GiH L is dihedral of order 2{q + l)/o; any two such subgroups Gi 
are conjugate. 

Proof. Let A denote the set of dihedral subgroups of L of order 2[q + l)/o. 
By Lemma lA.21 we have |A| = q{q — l)/2, and moreover G acts transitively 
on A by conjugation. Thus, for any G A, we have {(f' — q)/2 = |A| = 
\G: Ng{H)\. Since any two groups in A are conjugate, also their normalizers 
in G are conjugate. Conversely, if the subgroup Gi of G satisfies |G: Gi| = 
(g^ — q)/2 and Gi Pi L € A, then Gi normalizes H := Gi r\ L, so we must 
have Gi = Ng{H). The result follows. □ 

The main result on conjugacy classes of W\j2{q) is the following conse- 
quence of Lang's theorem on algebraic groups [III 2.7-2]. Let a E PrL2(g) 
be a field automorphism and ^ G PGL2(g); if //cr and a have the same order, 
then na = TaT~^ for some r G PGL2(g). We refer to this result as Lang's 
theorem. In the proof of Lemma [2.7t we need the following more general con- 
sequence of Lang's theorem: if a is a field automorphism in PrL2(A;), then 
for every fj, E PGL2(A;) there exists r G PGL2(A:) such that T{fia)T^^ = a. 

We also use Zsigmondy's theorem on primitive prime divisors. For a 
prime p and positive integer e, we say that a prime s is a primitive prime 
divisor of — 1 if e is the least positive integer i for which s divides — 1. 
Zsigmondy's theorem says that, for fixed p and e, there exists a primitive 
prime divisor of p^ — 1 unless either e = 2 (and p + 1 is a power of 2) or 
p = 2 (and e = 6). For a proof, see \30\ Thm. 6.2] or the original [33]. Note 
that a primitive prime divisor of p^ — 1 is coprime to e. 
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